IBM AIX CVE-2026-18840

Exploitation requires an existing local account on the affected AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at least low-privilege interactive access (PR:L per CVSS). No network-based attack path exists - the CVSS attack vector is local (AV:L), meaning the attacker must have a shell or equivalent local process execution capability. No user interaction is required from any other account (UI:N), and attack complexity is low (AC:L) once local access is established, implying no race conditions or special environmental states are required. Exploitation is limited by the hard prerequisite of a local account; organizations that enforce strict POWER system access controls, disable unnecessary user accounts on VIOS hosts, and prohibit direct VIOS shell access for non-administrators substantially reduce exploitability. SSVC confirms the attack is not automatable, consistent with the local-only vector precluding remote mass exploitation.

CVSS 7.8 High with AV:L/AC:L/PR:L/UI:N reflects a locally exploitable flaw requiring only a standard unprivileged account and no complex setup. SSVC independently corroborates the low exploitation urgency: exploitation is rated 'none' (no confirmed or public exploitation), the attack is non-automatable (consistent with local-only vector), and technical impact is 'total' - meaning successful exploitation is catastrophic in scope even if reach is constrained. EPSS at 0.17% (7th percentile) is notably low, suggesting the research and threat-actor community has not yet developed or published working exploits, and widespread opportunistic targeting is unlikely in the near term. The absence of a KEV listing reinforces that active exploitation is not confirmed. The primary risk driver is the low access complexity once local access is obtained: no user interaction and no special configuration are required beyond having a shell account. Environments with tight controls over local user accounts and strict POWER system access policies face meaningfully lower realized risk, while multi-tenant VIOS environments where multiple LPARs share a VIOS host face a higher blast radius if a low-privilege user in one context achieves code execution on the VIOS layer.

A low-privilege user with an existing shell account on an IBM AIX 7.3 or PowerVM VIOS 4.1 system crafts an input - such as a malformed argument to a privileged system call or VIOS management interface - containing a pointer value targeting a controlled memory region. The vulnerable component dereferences this pointer without validation, redirecting execution to attacker-supplied code and granting elevated or kernel-level code execution. No public proof-of-concept has been identified at time of analysis, and SSVC confirms no known exploitation.