CVE-2026-16927 is a high severity (CVSS 7.3) time-of-check to time-of-use race condition in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. A local attacker could gain root privileges. IBM provides fixes in service packs and VIOS fix packs, and the bulletin lists the affected filesets and levels.
What's affected
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. IBM's bulletin lists the affected fileset as bos.mp64 at these levels:
- AIX 7.2.5: 7.2.5.0 through 7.2.5.212
- AIX 7.3.2: 7.3.2.0 through 7.3.2.5
- AIX 7.3.3: 7.3.3.0 through 7.3.3.2
- AIX 7.3.4: 7.3.4.0 through 7.3.4.1
The same bulletin covers a large group of AIX and VIOS issues, and one set of fixes addresses all of them. Per the bulletin, the remediation levels are AIX 7.2 TL05 SP13, AIX 7.3 TL02 SP5, AIX 7.3 TL03 SP3 and AIX 7.3 TL04 SP2, and VIOS fix packs 4.1.0.50, 4.1.1.30 and 4.1.2.20. The service packs and fix packs are cumulative.
How to check if you're exposed
Run these on each AIX LPAR and on each VIOS:
oslevel -s
lslpp -L | grep -i bos.mp64
On a VIOS, log in as padmin and run ioslevel. Compare the bos.mp64 level against the ranges above. If the fileset is at or below the upper level for its release, the system is in scope. You can also check for the APAR that matches your release with instfix -ik IJ59565 (use IJ59566 for 7.2.5, IJ59565 for 7.3.2, IJ59564 for 7.3.3 and IJ59563 for 7.3.4).
What to do now
- List every AIX and VIOS system and record
oslevel -soriosleveloutput. - Compare each against the bos.mp64 ranges in IBM's bulletin 7283858.
- Download the matching service pack or VIOS fix pack from Fix Central. Plan for an LPAR reboot, or use AIX Live Update where it suits you.
- If you patch through NIM with nimsh secure, read the IBM note linked in the bulletin first, because the protocol between master and client changed.
- On VIOS 4.1.0 and 4.1.1, follow the post-update Postgres15 migration steps IBM links in the bulletin.
- Re-run the version check and record the new level.
Why it matters
CWE-367 is a time-of-check to time-of-use race. The system checks a condition, such as a file's owner or permissions, and acts on it later. If an attacker can change the object in the gap, the action applies to something the check never saw. IBM says the result can be root privileges for a local attacker.
This record's vector includes user interaction, which is less common for local privilege flaws, so a user action is part of the path. Race conditions are often hard to hit reliably, yet they are routinely turned into working attacks once understood. Patch rather than rely on difficulty.
The weakness class here is CWE-367 (Time-of-check Time-of-use Race Condition). The NVD record scores it 7.3, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector with local access, low attack complexity, low privileges required, user interaction required. Scope is unchanged. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Why does user interaction appear in this one?
The vector marks user interaction as required, so some step by a user is part of the attack path. IBM does not describe it, so rely on the patch rather than on guesses.
Sources
- IBM security bulletin for AIX and VIOS
- Safeguard Gold entry for CVE-2026-16927, which summarizes the NVD record
Last reviewed: 18 October 2026.
