---
id: CVE-2026-17024
title: Vulnerabilities in IBM AIX and PowerVM VIOS
summary: >-
  IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to
  execute arbitrary code due to improper certificate validation.
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-295
vendor: IBM
product: AIX
affected:
  - AIX 7.2
  - AIX 7.3
  - powervm_vios 4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-25T03:56:04.043383Z'
published: '2026-08-20'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:18:22.036Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-17024'
references:
  - url: 'https://www.ibm.com/support/pages/node/7283858'
tags:
  - cve.org
epss: 0.00353
epssPercentile: 0.29064
ingestedAt: '2026-11-05T20:33:06.653Z'
---

## Overview

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.

## Affected

- `AIX 7.2`
- `AIX 7.3`
- `powervm_vios 4.1`

## Remediation

A.  APARS



IBM has assigned the following APARs to this problem:

AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar





VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar







B.  FIXES



IBM strongly recommends addressing the vulnerability now.



 AIX and VIOS fixes are available and can be downloaded from Fix Central:  https://www.ibm.com/support/fixcentral 



 An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.



 IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.

AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13





PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50







Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .



Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:
 https://www.ibm.com/support/pages/node/7283157 



Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                  



          4.1.0.50 post-update instructions:  https://www.ibm.com/support/pages/node/7283819 
          4.1.1.30 post-update instructions:  https://www.ibm.com/support/pages/node/7283823