CVE-2026-16850

Received Received - Intake

Command Injection in IBM AIX and PowerVM VIOS via Router Advertisements

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-16850

EUVD

EUVD-2026-62745

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	From 7.2 (inc)
ibm	aix	From 7.3 (inc)
ibm	powervm_vios	From 4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It allows a remote attacker to execute arbitrary code by sending crafted Router Advertisements.

Impact Analysis

An attacker could exploit this to run malicious commands on affected systems, potentially leading to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face compliance penalties and reputational damage.

Mitigation Strategies

Apply IBM AIX and PowerVM VIOS security patches immediately. Disable IPv6 Router Advertisement processing if not required. Monitor network traffic for malformed Router Advertisements. Restrict access to network interfaces handling IPv6 traffic.

Hi! I’m here to help you understand CVE-2026-16850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70