Threat database

CVE-2026-16872 is a critical stack-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to execute arbitrary code without any privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-16869 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It involves an untrusted search path issue where improperly scrubbed environment variables could allow a local attacker to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant confidentiality, integrity, and availability impact. No vendor patch or remediation information is currently provided.

CVE-2026-16724 is an integer overflow or wraparound vulnerability (CWE-190) in IBM Virtualization Management Interface versions FW1110.00 through FW1110.30, FW1120.00, and FW1060.00 through FW1060.80. An attacker with authenticated administrator-level access can exploit this flaw to cause the Virtualization Management Interface (VMI) to crash. The VMI automatically restarts after a crash, but repeated exploitation could lead to sustained availability issues. The vulnerability has a medium severity rating with a CVSS score of 4.5.

CVE-2026-16866 is an out-of-bounds read vulnerability (CWE-125) affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability does not impact confidentiality but may affect integrity and availability. The CVSS score is 4.8, indicating a medium severity level.

CVE-2026-16865 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper neutralization of special elements in OS commands, leading to OS command injection. This flaw could allow a remote attacker to execute arbitrary code without privileges or user interaction.

CVE-2026-16864 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves a stack buffer overflow that could allow a remote attacker to execute arbitrary code without requiring privileges or user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-16862 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a stack buffer overflow that could allow a remote attacker to execute arbitrary code without any privileges or user interaction.

CVE-2026-16857 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper authentication that could allow a remote attacker to manipulate network traffic and DNS configuration. The vulnerability has a CVSS 3.1 score of 8.2, indicating a significant risk. No patch or remediation information is provided in the available data.

CVE-2026-16855 is a vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, involving a heap buffer overflow that can be triggered by a local attacker. This flaw could lead to a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5. No information about available patches or exploits in the wild is provided.

CVE-2026-16852 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an integer overflow or wraparound condition that could be exploited remotely to cause a denial of service (DoS). No confidentiality or integrity impacts are reported. There is no indication of active exploitation in the wild. Patch status is not confirmed from the provided data.

CVE-2026-16851 is a use-after-free vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. It has a CVSS v3.1 score of 7.4, indicating a high severity level.

CVE-2026-16850 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper privilege management (CWE-269) that could allow a remote attacker to execute arbitrary code via crafted Router Advertisements. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality, integrity, and availability.

CVE-2026-16849 is a medium severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper validation of an array index boundary, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-18871 is a stack-based buffer overflow vulnerability in IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It occurs during host firmware configuration parsing when an attacker with authenticated service-level access writes specially crafted configuration data. This can cause the host firmware boot stack to crash, potentially leading to memory corruption during system initialization. The impact affects system integrity and availability.

CVE-2026-16848 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of shell metacharacters in DHCP options, leading to OS command injection.

CVE-2026-17414 is a vulnerability in IBM PowerVM Hypervisor affecting certain firmware versions during network boot. An unauthenticated attacker on the same network can disrupt the boot process of a partition performing a network boot. If the partition's OS secure boot is not enabled (default setting), the attacker can substitute the boot image, compromising the integrity of the partition's loaded software. This vulnerability impacts confidentiality, integrity, and availability but only affects partitions actively performing network boot. Other partitions and the managed system remain unaffected.

CVE-2026-16847 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves a heap buffer overflow that could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges.

CVE-2026-16846 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, where a remote attacker could cause a denial of service due to a null pointer dereference. The vulnerability does not affect confidentiality or integrity but impacts availability. It has a CVSS 3.1 base score of 6.5, indicating medium severity.

CVE-2026-16845 is a critical heap buffer overflow vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges. The vulnerability is identified as CWE-787 (Out-of-bounds Write) and has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-16844 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of special elements in OS commands, classified as CWE-78 OS Command Injection.