[NEW] [high] IBM AIX and VIOS: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in IBM AIX and VIOS enable arbitrary code execution, privilege escalation, denial-of-service, information disclosure, file manipulation, and security bypass.

Who is affected

Organizations running IBM AIX and VIOS systems are affected across multiple impact vectors.

Urgency

High severity with multiple critical attack paths including RCE and privilege escalation; immediate patching required.

Action

Apply IBM security patches for all listed CVEs (CVE-2025-12817, CVE-2025-12818, CVE-2025-15649, CVE-2026-12087, CVE-2026-14970, CVE-2026-15061, CVE-2026-15065, CVE-2026-15068).

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-09-03

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2858

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2025-128170.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-128180.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-156490.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-120870.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-149700.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-150610.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-150650.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
• Moderate exploitation riskCVE-2026-150681.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-150780.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-162430.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.

Referenced CVEs

+12 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[UPDATE] [hoch] IBM License Metric Tool: Mehrere Schwachstellencert-bund
• highexploited[UPDATE] [hoch] IBM QRadar SIEM: Mehrere Schwachstellencert-bund
• unknownUSN-8675-2: Perl vulnerabilitiesubuntu
• unknownMultiples vulnérabilités dans les produits IBM (04 septembre 2026)cert-fr-avis
• highCVE-2026-16821: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated pr…nvd
• unknownexploitedMultiples vulnérabilités dans les produits IBM (28 août 2026)cert-fr-avis
• unknownUSN-8684-1: Perl vulnerabilitiesubuntu
• unknownUSN-8675-1: Perl vulnerabilitiesubuntu
• unknownNCSC-2026-0321 [1.00] [M/H] Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOSncsc-nl
• unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
• criticalCVE-2026-16882: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitra…nvd
• highCVE-2026-16877: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to e…nvd

Recent advisories for IBM AIX and VIOS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-16821: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated pr…nvd · 2026-08-28
• unknownNCSC-2026-0321 [1.00] [M/H] Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOSncsc-nl · 2026-08-21
• mediumCVE-2026-19783: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel mem…nvd · 2026-08-20
• highCVE-2026-19449: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an …nvd · 2026-08-20
• mediumCVE-2026-19448: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists i…nvd · 2026-08-20
• highCVE-2026-19446: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can sen…nvd · 2026-08-20

More from CERT-Bund (BSI) Security Advisories

• medium[NEU] [mittel] Microsoft Edge: Schwachstelle ermöglicht Cross-Site Scripting2026-09-14
• medium[NEU] [mittel] Citrix Systems Workspace App Windows: Mehrere Schwachstellen ermöglichen nicht spezifizierten A…2026-09-14
• medium[NEU] [mittel] wpa_supplicant: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen2026-09-14
• medium[NEU] [mittel] WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Offenlegung von Informationen2026-09-14
• low[UPDATE] [niedrig] 7-Zip: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen2026-09-14