CVE-2026-16822

Received Received - Intake

Improper Certificate Validation in IBM AIX and PowerVM VIOS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-16822

EUVD

EUVD-2026-62705

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote attacker to impersonate the TNC policy server and modify network traffic. It occurs due to improper certificate validation in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling man-in-the-middle attacks.

Impact Analysis

An attacker could intercept, alter, or redirect sensitive data transmitted over the network. This may lead to unauthorized access, data breaches, or service disruption for affected systems.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and confidentiality, such as GDPR's data protection principles or HIPAA's security rules, due to potential unauthorized data access or modification.

Mitigation Strategies

Apply IBM's official patches or updates for AIX 7.2/7.3 and PowerVM VIOS 4.1 to fix certificate validation issues. Disable unnecessary network services and restrict access to TNC policy server interfaces until patched.

Hi! I’m here to help you understand CVE-2026-16822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70