IBM has disclosed a CVSS 9.1 flaw in AIX 7.2/7.3 and PowerVM VIOS 4.1 that lets an unauthenticated remote attacker overwrite arbitrary files on affected systems.
What Is It
CVE-2026-16926 affects IBM AIX and IBM PowerVM VIOS. Per IBM's advisory, the flaw "could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input."
Two separate things are worth keeping straight here. The behavior IBM describes, improper neutralization of special elements in input, is the input-handling failure (the CWE-138 "Improper Neutralization of Special Elements" family). The weakness formally assigned to this CVE is CWE-73, External Control of File Name or Path, which describes the consequence: attacker-influenced input reaching a file path. The neutralization failure is the mechanism; external control of the file path is the classified weakness. They are related but distinct, and only CWE-73 is the assigned classification.
IBM PSIRT rates it CVSS 3.1 base score 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The exploitability sub-score is a maximum 3.9: network attack vector, low complexity, no privileges required, and no user interaction.
Why It Matters
The impact profile is integrity and availability, both HIGH, with no confidentiality impact. That maps cleanly to the described behavior; an attacker does not read data, they write over it. Arbitrary file overwrite on a Unix platform is a well-understood path to system compromise or denial of service depending on which files an attacker can reach.
The combination of no authentication, no user interaction, and remote reachability means there is no meaningful barrier between an exposed system and an attempt. AIX and VIOS commonly underpin production workloads on IBM Power hardware, where unplanned downtime is expensive and patch windows are scarce.
This CVE does not currently appear in the CISA Known Exploited Vulnerabilities catalog. No KEV entry, no confirmed active exploitation, and no federal remediation deadline are associated with it as of this writing.
What's Vulnerable
- IBM AIX 7.2 (including 7.2.0)
- IBM AIX 7.3 (including 7.3.0)
- IBM PowerVM VIOS 4.1 (including 4.1.0)
Patch Status
IBM published advisory node 7283858 as the sole reference for this CVE. The NVD record is in Received status; it was published 2026-08-20 and has not yet been enriched or analyzed by NVD, so the scoring, weakness classification, and affected-version data all reflect IBM PSIRT's own submission. Consult the IBM advisory directly for fix packs and interim fix availability; no remediation details beyond that reference are present in the supplied data.
Sources
- NVD, CVE-2026-16926: https://nvd.nist.gov/vuln/detail/CVE-2026-16926
- IBM Support Advisory (node 7283858): https://www.ibm.com/support/pages/node/7283858
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- MITRE CWE-73; External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
- MITRE CWE-138; Improper Neutralization of Special Elements: https://cwe.mitre.org/data/definitions/138.html