EXPOSURES › CVE-2026-16919

CVE-2026-16919

CRITICAL

DETAIL

SourceNVD · cve Published2026-08-19 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-16919 ↗

⚡ RCE SHAME 85/100 rceunpatchedexploited-in-wild

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 suffer a critical remote code execution flaw from improper pointer validation.

A remote attacker can execute arbitrary code on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems due to improper validation of network-supplied pointers. DIB organizations must patch these systems immediately to prevent remote compromise, as this flaw enables full system control without requiring prior access. The severity is critical (CVSS 9.8) and the flaw is actively exploitable in the wild.

Shame score — A critical remote code execution flaw in widely deployed IBM enterprise operating systems and virtualization platforms, allowing unauthenticated remote attackers to execute arbitrary code without any prior access or authentication.

▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED

IBM · vendor aix · product vios · product

DESCRIPTION

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.

AFFECTED FEDRAMP PRODUCTS · 5

PRODUCT	PROVIDER	STATUS	MATCH
IBM Cloud for Government IBM	IBM	Authorized	vendor-exact · 0.90
IBM Federal HR Cloud IBM	IBM	Authorized	vendor-exact · 0.90
IBM Maximo and TRIRIGA on Cloud for U.S. Federal IBM	IBM	Authorized	vendor-exact · 0.90
MaaS360 Enterprise Mobility Management IBM	IBM	Authorized	vendor-exact · 0.90
SmartCloud for Government IBM	IBM	Authorized	vendor-exact · 0.90