CVE-2026-17436 is a high severity (CVSS 8.8) heap-based buffer overflow in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. A remote attacker could execute arbitrary code, and the vector shows an adjacent network path with low complexity. IBM lists cumulative service packs and fix packs as the fix.
What's affected
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. IBM's bulletin is a shared one that lists many AIX and VIOS vulnerabilities, and its change history shows an initial publication on 15 August 2026. The affected fileset is bos.mp64 at these levels:
- AIX 7.2.5: 7.2.5.0 to 7.2.5.212
- AIX 7.3.2: 7.3.2.0 to 7.3.2.5
- AIX 7.3.3: 7.3.3.0 to 7.3.3.2
- AIX 7.3.4: 7.3.4.0 to 7.3.4.1
IBM's remediation levels are AIX 7.2 TL05 SP13, 7.3 TL02 SP5, 7.3 TL03 SP3 and 7.3 TL04 SP2, and VIOS fix packs 4.1.0.50, 4.1.1.30 and 4.1.2.20. These service packs are cumulative. IBM lists no workaround or mitigation.
How to check if you're exposed
Check the AIX level and the affected fileset on each LPAR.
oslevel -s
lslpp -L | grep -i bos.mp64
On a VIOS, run ioslevel as padmin. If the bos.mp64 level falls in one of the ranges above, the system is affected. IBM also assigns APARs: IJ59566 for AIX 7.2.5, IJ59565 for 7.3.2, IJ59564 for 7.3.3 and IJ59563 for 7.3.4. The vector is adjacent, so list the hosts that share a network segment with each LPAR and VIOS.
What to do now
- List every AIX LPAR and VIOS, with its technology level and service pack.
- Download the service pack or fix pack for your level from IBM Fix Central.
- Plan the LPAR reboot, or use Live Update on AIX where it fits, because IBM says a reboot is needed to complete the update.
- Read IBM's notes on nimsh secure and, for VIOS 4.1.0 and 4.1.1, the post-update steps for the Postgres15 migration.
- Recheck
oslevel -safter the update and record it.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write), a heap overflow. The vector shows an adjacent attack with low complexity, no privileges and no user interaction, and high impact on all three security goals. That is the highest score among the AIX issues in this bulletin that we cover here.
Because the path is adjacent, segmenting networks helps limit who can try it, but the fix is the update. Treat VIOS as part of the same project, since it carries the virtual network and storage for many LPARs. CISA does not list this CVE as known exploited.
Quick check
Should I patch VIOS before AIX?
IBM lists both in the same bulletin. Plan them together, and follow IBM's post-update steps for VIOS 4.1.0 and 4.1.1.
Sources
Last reviewed: 19 October 2026.
