Threat database

CVE-2026-18832 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a heap-based buffer overflow that could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges.

CVE-2026-17195 is an out-of-bounds write vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability.

CVE-2026-17171 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, involving improper resolution of symbolic links before file access. This flaw allows a local attacker to overwrite arbitrary files by exploiting the improper link resolution behavior. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability.

CVE-2026-17124 is a high severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves an out-of-bounds read (CWE-125) that could allow a local attacker to execute arbitrary code without user interaction. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch information is provided in the source data.

CVE-2026-16944 is a stack-based buffer overflow vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a local attacker with high privileges to execute arbitrary code on the affected systems. The vulnerability has a CVSS 3.1 base score of 6.7, indicating a medium severity level. No public exploits are known, and no vendor patch information is provided in the available data.

CVE-2026-16935 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a time-of-check to time-of-use (TOCTOU) race condition that could allow a local attacker to gain elevated privileges. The vulnerability does not have confirmed exploits in the wild as of the publication date. The CVSS 3.1 base score is 7.8, indicating significant impact on confidentiality, integrity, and availability if exploited.

CVE-2026-16897 is a medium severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves a divide-by-zero condition (CWE-369) that can be triggered by a local attacker, potentially causing a denial of service via an out-of-bounds write.

CVE-2026-16845 is a critical heap buffer overflow vulnerability in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to execute arbitrary code without requiring user interaction or privileges. The vulnerability is identified as CWE-787 (Out-of-bounds Write) and has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls.  This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.

IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.

IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls.

IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls.

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 251207.