Threat database

CVE-2026-16909 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an off-by-one error in bounds checking, classified as a CWE-128 wrap-around error, which could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges.

CVE-2026-16903 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves an out-of-bounds write (CWE-787) that could allow a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No information about available patches or vendor advisories is provided.

CVE-2026-16901 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an out-of-bounds write (CWE-787) that could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges.

CVE-2026-16897 is a medium severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a divide-by-zero condition (CWE-369) that can be triggered by a local attacker, potentially causing a denial of service via an out-of-bounds write.

CVE-2026-16894 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a stack buffer overflow that could allow a remote attacker to execute arbitrary code without any privileges or user interaction.

CVE-2026-16891 is an out-of-bounds read vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to read sensitive information from memory. The vulnerability has a low CVSS score of 3.3, indicating limited impact and requiring local privileges to exploit. No known exploits are reported in the wild, and no official patch information is provided.

CVE-2026-16890 is an integer overflow or wraparound vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to obtain sensitive information or cause a denial of service. The vulnerability has a low severity rating with a CVSS score of 3.6.

CVE-2026-16886 is a medium severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves an out-of-bounds write that could be triggered remotely, potentially causing a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-16888 is a path traversal vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to access sensitive information by improperly limiting pathname access to restricted directories. The vulnerability has a low severity rating with a CVSS score of 3.7.

CVE-2026-16885 is a critical stack-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to execute arbitrary code without any privileges or user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17028 is an out-of-bounds read vulnerability (CWE-125) in IBM PowerVM Hypervisor partition firmware affecting certain firmware versions during iSCSI SAN network boot. An unauthenticated attacker on the same network can disrupt the boot process of a partition performing network boot, causing availability impact to that partition only. Other partitions and the managed system remain unaffected.

CVE-2026-17091 is an integer overflow or wraparound vulnerability in IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An attacker with root access to a guest partition can exploit this flaw by issuing a crafted hypervisor call that injects arbitrary data into hypervisor or partition memory. This can cause a crash leading to a full platform reboot and termination of all hosted partitions or memory corruption. The hypervisor restarts automatically, but repeated exploitation may cause sustained availability issues. The vulnerability impacts system integrity and availability.

CVE-2026-16883 is an out-of-bounds read vulnerability (CWE-125) affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to read sensitive information from memory. The vulnerability has a medium severity with a CVSS score of 5.5. No public exploits or patches have been indicated in the provided data.

CVE-2026-16882 is a critical OS command injection vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw allows a remote attacker to execute arbitrary commands due to improper neutralization of special elements in OS commands. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No vendor patch or remediation information is provided in the available data.

CVE-2026-17097 is a vulnerability in IBM PowerVM Hypervisor affecting multiple firmware versions. It involves improper validation of array indices in the hypervisor call interface. An attacker with root access to a guest partition can exploit this flaw to cause a virtual processor to become permanently unresponsive, requiring a full platform reboot. Additionally, exploitation may lead to unintended data injection into hypervisor or partition memory without attacker control over the target location. The vulnerability impacts system integrity and availability.

CVE-2026-16877 is a high-severity stack-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote authenticated attacker to execute arbitrary code on the affected systems without user interaction.

CVE-2026-16875 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a local attacker to execute arbitrary OS commands due to improper neutralization of special elements (shell metacharacter injection). This vulnerability does not require user interaction and can lead to full confidentiality, integrity, and availability compromise.

CVE-2026-16874 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper privilege management due to incorrect enforcement of Role-Based Access Control (RBAC) authentication roles. This flaw could allow a local attacker with limited privileges to escalate to root privileges without user interaction.

CVE-2026-16873 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an out-of-bounds write that could allow a local attacker to escalate privileges on the affected systems.

CVE-2026-18821 is a high-severity vulnerability in IBM PowerVM Hypervisor firmware affecting partitions during network boot. An unauthenticated attacker on the same network can send a malformed packet to a partition undergoing network boot, leading to arbitrary code execution within that partition's firmware. This compromises the confidentiality, integrity, and availability of the affected partition and everything it subsequently loads. Other partitions and the managed system remain unaffected. The vulnerability is related to an out-of-bounds write (CWE-787) in the partition firmware.