IBM: 25 Vulnerabilities Across AIX, PowerVM, and Storage Disclosed Together
IBM disclosed 25 vulnerabilities across its AIX, PowerVM, System Storage, and other product lines on August 19, 2026, with several critical flaws enabling remote code execution.
Key findings
- 25 IBM vulnerabilities disclosed on August 19, 2026, affecting AIX, PowerVM, System Storage, and more.
- Multiple critical vulnerabilities in AIX and PowerVM allow for remote code execution.
- Flaws in System Storage DS8A00/DS8900F enable data access and privilege escalation.
- PowerVM Hypervisor and Power Systems Firmware have numerous high-severity issues impacting security and availability.
- IBM i and RSCT also affected by vulnerabilities leading to DoS and information disclosure.
On August 19, 2026, a significant batch of 25 vulnerabilities was disclosed for IBM AIX, IBM PowerVM Hypervisor, IBM Power Systems Firmware, IBM System Storage DS8A00, IBM DS8900F, IBM Portieris, IBM i, and IBM Reliable Scalable Cluster Technology. The vulnerabilities were disclosed within a two-hour window, indicating a coordinated disclosure event. These vulnerabilities span a range of severities, from low to critical, with several allowing for remote code execution and privilege escalation.
A notable cluster of vulnerabilities affects IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. This group includes critical severity flaws such as stack buffer overflows (CVE-2026-16913, CVE-2026-16911, CVE-2026-16909), integer overflows (CVE-2026-16917), and improper validation of network-supplied pointers (CVE-2026-16919), all potentially leading to remote code execution. Additionally, a local attacker could execute arbitrary code via an out-of-bounds write in CVE-2026-16914. These AIX and VIOS vulnerabilities were highlighted by Vypr Intelligence, noting the potential for remote code execution and significant local privilege escalation risks.
Another substantial group of vulnerabilities impacts IBM PowerVM Hypervisor and IBM Power Systems Firmware across various versions. These include issues such as improper authorization of pod owner references in Portieris (CVE-2026-18544), which could allow an attacker to bypass policy enforcement. Several PowerVM vulnerabilities (e.g., CVE-2026-18821, CVE-2026-17414) could be exploited by unauthenticated attackers on the same network during network boot. Other PowerVM and Power Systems Firmware flaws involve issues like reduced AES key strength (CVE-2026-4936), less entropy in encryption (CVE-2026-4937), arbitrary code execution in BMC firmware updates (CVE-2026-18849), and disruption of host processor state (CVE-2026-17063, CVE-2026-16933).
IBM System Storage DS8A00 and DS8900F are affected by vulnerabilities allowing authenticated users to read or modify command history (CVE-2025-36398) or create privileged users (CVE-2025-36255). CVE-2025-36254 in these systems could allow an attacker to bypass security authentication by improperly encoding DSCLI command output. IBM i systems face risks from integer underflows (CVE-2026-18102) and out-of-bounds reads (CVE-2026-17015), potentially leading to denial of service and information disclosure. IBM Reliable Scalable Cluster Technology (RSCT) has a denial-of-service vulnerability due to improper input validation (CVE-2026-14514).
The disclosures on August 19, 2026, underscore the importance of timely patching for IBM's diverse product portfolio. Users of affected AIX, PowerVM, Power Systems Firmware, System Storage, IBM i, Portieris, and RSCT products should consult IBM's security advisories for specific version information and apply available updates to mitigate the risks associated with these vulnerabilities. The broad range of affected products and the severity of some flaws highlight the need for continuous security vigilance within these complex enterprise environments.