Threat database

CVE-2026-16842 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to execute arbitrary OS commands. This occurs due to improper neutralization of special elements in OS commands, classified as CWE-78 OS Command Injection. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-16841 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves a stack buffer overflow that could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges. The vulnerability is classified as an out-of-bounds write (CWE-787).

CVE-2026-16661 is a high-severity integer overflow vulnerability in IBM PowerVM Hypervisor service processor mailbox interface. It affects multiple firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can exploit this flaw to execute arbitrary code in the host firmware runtime, potentially gaining full control over the managed system. This leads to confidentiality, integrity, and availability impacts on the affected system.

CVE-2026-16840 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, involving an out-of-bounds write that could allow a remote attacker to execute arbitrary code without any privileges or user interaction.

CVE-2026-16839 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves an integer underflow in the IPv4 IP-options parser that could allow a remote attacker to read out-of-bounds memory, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.4, indicating a severe impact on confidentiality, integrity, and availability.

CVE-2026-16838 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves a time-of-check to time-of-use (TOCTOU) race condition that could allow a local attacker to overwrite critical files and access sensitive information.

CVE-2026-16837 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption due to improper handling of a missing SSL client certificate, which could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but results in service disruption.

CVE-2026-16836 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption that could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. There is no information provided about patches or fixes.

CVE-2026-16834 is a critical integer underflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to cause a denial of service condition. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and has a CVSS 3.1 base score of 9.8, indicating high severity with potential impacts on confidentiality, integrity, and availability.

CVE-2026-16833 is an out-of-bounds read vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to disclose kernel memory. The vulnerability has a medium severity rating with a CVSS score of 5.3. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

CVE-2026-16831 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption that could be triggered remotely, leading to a denial of service condition. The vulnerability does not impact confidentiality or integrity but results in service disruption.

CVE-2026-16829 is a medium severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It involves a NULL pointer dereference that could be triggered remotely, leading to a denial of service condition. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.

CVE-2026-16825 is an out-of-bounds write vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service. The vulnerability has a medium severity rating with a CVSS score of 4.2. No patch or remediation information is provided in the available data.

CVE-2026-16824 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves uncontrolled resource consumption caused by unbounded recursion, which can be triggered remotely and lead to a denial of service condition.

CVE-2026-16822 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, involving improper certificate validation. This flaw could allow a remote attacker to impersonate the TNC policy server and modify network traffic. The vulnerability has a high CVSS score of 9.3, indicating significant risk. No information about available patches or vendor advisories is provided.

CVE-2026-16933 is an integer overflow or wraparound vulnerability in IBM Power Systems Firmware affecting multiple firmware versions. It exists in the interface between the BMC/FSP and the host system. An attacker with service or root access to the BMC/FSP can exploit this flaw to read and write arbitrary host system memory, gaining full control over the host and all hosted partitions. This results in a critical impact on confidentiality, integrity, and availability.

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 contain an incorrect authorization vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can disrupt the host processor state, impacting confidentiality and availability of the managed system and all hosted partitions.

CVE-2026-16687 is a critical stack-based buffer overflow vulnerability in the ASMI web interface of IBM Power Systems Firmware. It affects multiple firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An unauthenticated attacker with network access can send a malformed request to the FSP, leading to arbitrary code execution and full control over the managed system. This results in a complete compromise of confidentiality, integrity, and availability.