What’s Vulnerable › Vulnerabilities
CVE-2026-19442: Vulnerabilities in IBM AIX and PowerVM VIOS
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-20 · updated 2026-10-26
- Weakness: CWE-822
Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel.
Affected products
- IBM AIX: from 7.2.5 through 7.2.5.212; from 7.3.2 through 7.3.2.5; from 7.3.3 through 7.3.3.2; from 7.3.4 through 7.3.4.1
- IBM VIOS: from 4.1.0 before 4.1.0.50; from 4.1.1.0 before 4.1.1.30; from 4.1.2.0 before 4.1.2.20 — fixed in 4.1.0.50, 4.1.1.30, 4.1.2.20
How to fix
Upgrade to a fixed version: IBM VIOS 4.1.0.50, 4.1.1.30, 4.1.2.20. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19442 or the next vulnerability affects your stack