CVE-2026-16846

Received Received - Intake

Null Pointer Dereference in IBM AIX and PowerVM VIOS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a null pointer dereference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-16846

EUVD

EUVD-2026-62736

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 caused by a remote attacker exploiting a null pointer dereference. This means the system crashes or becomes unresponsive when processing certain network requests.

Detection Guidance

Detection requires checking for IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1 versions. Use system commands like oslevel -s for AIX version and ioslevel for VIOS version. Monitor network traffic for unusual patterns indicating denial of service attempts.

Impact Analysis

If exploited, this vulnerability could cause your IBM AIX or PowerVM VIOS systems to stop responding, leading to service disruptions. It may require manual intervention to restart the affected systems, causing downtime for critical operations.

Mitigation Strategies

Apply IBM-provided patches or updates for AIX 7.2, 7.3, and PowerVM VIOS 4.1. Restrict network access to affected systems using firewalls. Monitor for abnormal traffic or crashes indicating exploitation attempts.

Hi! I’m here to help you understand CVE-2026-16846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70