IBM has disclosed a CVSS 9.9 OS command injection flaw affecting IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 that lets a remote authenticated attacker execute arbitrary commands.
What Is It
CVE-2026-16816 is an improper neutralization of special elements used in an OS command (CWE-78) in IBM AIX and IBM PowerVM VIOS. According to IBM's advisory, the flaw could allow a remote authenticated attacker to execute arbitrary commands on the affected system.
The CVSS 3.1 base score is 9.9 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The record was published by IBM PSIRT on 2026-08-19 and currently carries NVD status "Received."
Why It Matters
The scoring tells the story. The attack is reachable over the network (AV:N) at low complexity (AC:L), needs no user interaction (UI:N), and requires only low privileges (PR:L), any authenticated account is enough. Scope is Changed (S:C), meaning successful exploitation reaches beyond the vulnerable component's original security boundary, and all three impact metrics, confidentiality, integrity, and availability, are rated High.
AIX and PowerVM VIOS underpin IBM Power infrastructure, so a command execution primitive on these hosts is a serious foothold. As of publication, CVE-2026-16816 does not appear in CISA's Known Exploited Vulnerabilities catalog (checkable at the catalog URL below), and there is no public confirmation of active exploitation at this time.
What's Vulnerable
Per the affected-product data on the NVD record:
- IBM AIX: versions 7.2 and 7.3 (CPEs cover
7.2,7.2.0,7.3,7.3.0) - IBM PowerVM VIOS: version 4.1 (CPEs cover
4.1,4.1.0)
Patch Status
IBM has published a support advisory for this issue at https://www.ibm.com/support/pages/node/7283858, which is the sole reference on the NVD record. The NVD record does not enumerate specific fix levels, iFixes, or APARs; administrators should consult that IBM advisory directly for the applicable remediation. Because the CVE is absent from the CISA KEV catalog, no federally mandated BOD 22-01 remediation due date applies to it.
Sources
- NVD, CVE-2026-16816: https://nvd.nist.gov/vuln/detail/CVE-2026-16816
- IBM Support Advisory ([email protected]): https://www.ibm.com/support/pages/node/7283858
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog