Do Son 
TL;DR
IBM patched a large batch of IBM AIX vulnerabilities on August 15, 2026. Many allow remote code execution, and the worst reach a CVSS score of 9.9. IBM has shipped fixes for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1.
- Total: 7 CVEs
- Severity: 7 Critical
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-18835
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-18835 | 9.9 | CWE-78 | — | Not exploited |
| CVE-2026-16816 | 9.9 | CWE-78 | — | Not exploited |
| CVE-2026-15068 | 9.9 | CWE-78 | — | Not exploited |
| CVE-2026-16656 | 9.8 | CWE-287 | — | Not exploited |
| CVE-2026-16919 | 9.8 | CWE-843 | — | Not exploited |
| CVE-2026-17136 | 9.8 | CWE-134 | — | Not exploited |
| CVE-2026-16882 | 9.8 | CWE-78 | — | Not exploited |
Why it matters
AIX runs core workloads on IBM Power servers. Banks, telecoms, and large enterprises depend on it. A remote code execution flaw on such systems is a serious risk.
This bulletin stands out for its scale and severity. It fixes dozens of flaws, and many carry critical CVSS scores at or above 9.0. Several need no authentication at all.
How the attack works
The bulletin groups issues by type. The most severe fall into a few clear buckets.
Command injection at CVSS 9.9
Three OS command injection flaws top the list. CVE-2026-18835, CVE-2026-16816, and CVE-2026-15068 each score 9.9. An authenticated attacker can run arbitrary commands on the host.
Unauthenticated remote code execution
Many memory bugs allow remote code execution without login. CVE-2026-16919 is a type confusion flaw scored 9.8. CVE-2026-16656 lets a remote attacker gain root through improper authentication, also at 9.8.
Other 9.8 flaws include a format string bug, CVE-2026-17136, and a command injection issue, CVE-2026-16882. Stack and heap overflows appear throughout the list.
Bundled components
The update also covers third-party software. It includes fixes for PostgreSQL, OpenSSH, Java SE, and several Perl modules shipped with AIX.
Affected versions
IBM lists AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 as affected. The flaws sit in the bos.mp64 fileset across multiple levels. IBM does not report public exploitation or any known proof-of-concept for these IBM AIX vulnerabilities.
Patch and mitigation steps
IBM says to act now. Fixes ship as cumulative Service Packs and Fix Packs. You can download them from IBM’s security bulletin and Fix Central.
The bulletin lists no workarounds, so patching is the main path. An LPAR reboot completes the update, though AIX Live Update can avoid one. Admins should test the packs first, then roll them out quickly.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
