CVE-2026-16932
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.
Risk Assessment
A local attacker can gain the ability to execute arbitrary commands, potentially leading to system takeover or privilege escalation.
Recommendation
Apply IBM-provided fixes for AIX and PowerVM VIOS to eliminate the vulnerability.
Other vulnerabilities in IBM AIX
See all- CVE-2016-3053High
IBM AIX contains an unspecified vulnerability that allows a locally authenticated user to obtain root level privileges.
- CVE-2026-18835Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-17422Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17160Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
- CVE-2026-17157Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
- CVE-2026-17152Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17145Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.
- CVE-2026-17142Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.
- CVE-2026-17141Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17136Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.
Original NVD description (English source)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.