NCSC-2026-0321 [1.00] [M/H] Multiple vulnerabilities fixed in IBM AIX and IBM PowerVM VIOS

CSIRTS triage

What

IBM has fixed multiple vulnerabilities in AIX, PowerVM VIOS, and related products including DB2, WebSphere, Oracle Java, GraalVM, PostgreSQL, OpenSSH, and Perl that allow denial of service, privilege escalation, arbitrary code execution, and information disclosure.

Who is affected

Deployments of IBM AIX, PowerVM VIOS, and associated database, application server, and utility software are affected.

Urgency

High urgency; vulnerabilities span arbitrary code execution with root/admin privileges, data manipulation, and circumvention of security measures across critical infrastructure products.

Action

Apply IBM security updates for AIX and PowerVM VIOS and coordinate updates for dependent products (DB2, WebSphere, Java, GraalVM, PostgreSQL, OpenSSH, Perl) addressing the listed CVEs.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

NCSC-NL Advisories (NL · national-cert · site)

Severity

unknown

Published

2026-08-21

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0321

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2025-128170.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-128180.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2025-156490.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-20030.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-20040.78% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
• Moderate exploitation riskCVE-2026-20051.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all EPSS-scored CVEs.
• Moderate exploitation riskCVE-2026-20061.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-64720.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Moderate exploitation riskCVE-2026-64731.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 60% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-64740.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.

Referenced CVEs

+12 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownUSN-8675-1: Perl vulnerabilitiesubuntu
• high[NEW] [high] IBM License Metric Tool: Multiple vulnerabilitiescert-bund
• high[UPDATE] [high] PostgreSQL: Multiple vulnerabilitiescert-bund
• high[NEW] [high] IBM AIX and VIOS: Multiple vulnerabilitiescert-bund
• unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
• high[NEW] [high] Splunk SOAR: Multiple vulnerabilitiescert-bund
• unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
• highCVE-2026-16852: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial …nvd
• highCVE-2026-16851: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial …nvd
• highCVE-2026-16850: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitra…nvd
• mediumCVE-2026-16849: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial …nvd
• highCVE-2026-16848: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitra…nvd

Recent advisories for IBM AIX and

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] IBM AIX and VIOS: Multiple vulnerabilitiescert-bund · 2026-08-21
• mediumCVE-2026-19783: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel mem…nvd · 2026-08-20
• highCVE-2026-19449: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an …nvd · 2026-08-20
• mediumCVE-2026-19448: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists i…nvd · 2026-08-20
• highCVE-2026-19446: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can sen…nvd · 2026-08-20
• highCVE-2026-19442: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX …nvd · 2026-08-20

More from NCSC-NL Advisories

• unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.2026-08-25
• unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak2026-08-25
• unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian products2026-08-24
• unknownNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suite2026-08-23
• unknownNCSC-2026-0323 [1.00] [M/H] Vulnerabilities fixed in Cisco Secure Workload2026-08-21