CVE-2026-18840

Received Received - Intake

IBM AIX and PowerVM Local Code Execution Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-18840

EUVD

EUVD-2026-63747

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker to execute arbitrary code. It occurs due to improper validation of an attacker-controlled pointer, which could let the attacker manipulate memory and run malicious commands on the system.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to gain full control over the affected system. This includes executing arbitrary code, installing malware, stealing sensitive data, or disrupting services. The high CVSS score indicates significant risk.

Compliance Impact

This vulnerability allows local attackers to execute arbitrary code, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR and HIPAA by enabling data breaches or unauthorized processing of personal health information.

Mitigation Strategies

Apply IBM-provided patches or updates for AIX 7.2, 7.3, and PowerVM VIOS 4.1 to address the improper pointer validation issue. Monitor IBM's security advisories for fixes and restrict local access to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-18840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70