CVE-2026-18824 is a high severity (CVSS 8.4) OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. A remote authenticated attacker could run arbitrary commands. IBM delivers fixes through service packs and fix packs described in bulletin 7283858, and lists no workaround.
What's affected
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 are affected. IBM's bulletin 7283858 is shared by several AIX and VIOS CVEs and says fixes are delivered as service packs and fix packs inside cumulative maintenance packages. The text we could read did not state the exact fix level for this CVE, and the bulletin has special steps for applying updates through NIM and extra steps after VIOS 4.1.0 and 4.1.1 updates. Read the Remediation and Fixes section of the bulletin for the level that applies to your system rather than relying on a number from this post.
IBM lists no workaround for this issue.
IBM's score is 8.4 with the vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, matching the record. The attacker needs high privileges, and some user interaction is part of the vector.
How to check if you're exposed
Find the technology level and service pack of each LPAR. On AIX, run:
oslevel -s
On a VIOS, sign in as padmin and run:
ioslevel
Compare the result with the fixed levels in the Remediation section of IBM's bulletin. If you use NIM, list the clients and their levels from the NIM master so you can plan the update in one pass.
Then review who holds the privileges that the attack requires. High privileges are part of the vector, so a small, well-controlled group of administrators lowers risk.
What to do now
- Collect the AIX and VIOS levels for all LPARs.
- Read the Remediation and Fixes section of bulletin 7283858.
- Apply the listed service pack or fix pack, following IBM's NIM and VIOS notes.
- Review administrative accounts and remove those that are no longer used.
- Confirm the new level with oslevel or ioslevel after the update.
Why it matters
The weakness class is CWE-78, OS command injection. A component builds a command line from input and passes it to the shell without neutralizing special characters. Anything the attacker can place in that input may be run as a command, with the rights of the calling process.
Here, the vector requires high privileges and user interaction, which lowers the odds of an attack. The scope is changed, and impact on confidentiality, integrity and availability is high, which gives the 8.4 score. On a hypervisor related system such as VIOS, a command execution flaw can matter beyond one machine, since VIOS serves client partitions. KEV status is false.
Quick check
Where do I find the exact fix level?
In the Remediation and Fixes section of IBM bulletin 7283858. We could not confirm a per-CVE level from the text we read.
Do I need special steps on VIOS?
The bulletin describes extra steps after VIOS 4.1.0 and 4.1.1 updates, and special steps when applying through NIM secure.
Sources
Last reviewed: 18 October 2026.
