CVE-2026-16972: Medium Improper Authentication in IBM AIX and VIOS

CVE-2026-16972 is a medium severity (CVSS 6.5) improper authentication flaw in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. A remote attacker could obtain sensitive information. IBM provides fixes through service packs and VIOS fix packs in one bulletin.

What's affected

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. IBM's bulletin lists the affected fileset as bos.mp64 at these levels:

• AIX 7.2.5: 7.2.5.0 through 7.2.5.212
• AIX 7.3.2: 7.3.2.0 through 7.3.2.5
• AIX 7.3.3: 7.3.3.0 through 7.3.3.2
• AIX 7.3.4: 7.3.4.0 through 7.3.4.1

The same bulletin covers a large group of AIX and VIOS issues, and one set of fixes addresses all of them. Per the bulletin, the remediation levels are AIX 7.2 TL05 SP13, AIX 7.3 TL02 SP5, AIX 7.3 TL03 SP3 and AIX 7.3 TL04 SP2, and VIOS fix packs 4.1.0.50, 4.1.1.30 and 4.1.2.20. The service packs and fix packs are cumulative.

How to check if you're exposed

Run these on each AIX LPAR and on each VIOS:

oslevel -s
lslpp -L | grep -i bos.mp64

On a VIOS, log in as padmin and run ioslevel. Compare the bos.mp64 level against the ranges above. If the fileset is at or below the upper level for its release, the system is in scope. You can also check for the APAR that matches your release with instfix -ik IJ59565 (use IJ59566 for 7.2.5, IJ59565 for 7.3.2, IJ59564 for 7.3.3 and IJ59563 for 7.3.4).

What to do now

1. List every AIX and VIOS system and record oslevel -s or ioslevel output.
2. Compare each against the bos.mp64 ranges in IBM's bulletin 7283858.
3. Download the matching service pack or VIOS fix pack from Fix Central. Plan for an LPAR reboot, or use AIX Live Update where it suits you.
4. If you patch through NIM with nimsh secure, read the IBM note linked in the bulletin first, because the protocol between master and client changed.
5. On VIOS 4.1.0 and 4.1.1, follow the post-update Postgres15 migration steps IBM links in the bulletin.
6. Re-run the version check and record the new level.

Why it matters

CWE-287 is improper authentication. The service does not fully verify who a caller is before returning data. The vector shows network access, low complexity, no privileges and no interaction, with low confidentiality and low availability impact. That is why the score stays at 6.5 despite being reachable remotely.

Unauthenticated network flaws are the ones attackers scan for. Even low impact ones can leak configuration details that help later steps. IBM does not name the service, so you cannot cut exposure by disabling a known daemon. The fix pack is the reliable answer.

The weakness class here is CWE-287 (Improper Authentication). The NVD record scores it 6.5, which is medium severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated low, none and low. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.

Try it yourself

A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IBM security bulletin for AIX and VIOS
• Safeguard Gold entry for CVE-2026-16972, which summarizes the NVD record

Last reviewed: 18 October 2026.