Security readout for executives and security teams
Plain-English summary
This critical memory-safety flaw could let an unauthenticated remote attacker take full control of affected IBM AIX or PowerVM VIOS systems. Successful exploitation could expose sensitive data, alter systems, or interrupt operations. The supplied sources do not identify the vulnerable service or network port.
Executive priority
Prioritize immediate identification and remediation of affected production, virtualization, and externally reachable systems. The potential impact is system-wide compromise without authentication. Where rapid patching is operationally difficult, require documented network restrictions, heightened monitoring, and a time-bound remediation plan based on IBM guidance.
Technical view
CVE-2026-17118 is a use-after-free vulnerability (CWE-416) affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. Its CVSS 3.1 score is 9.8, reflecting network accessibility, low attack complexity, no required privileges or user interaction, and potentially complete confidentiality, integrity, and availability impact.
Likely exposure
Exposure exists where affected AIX or VIOS versions are deployed and the vulnerable functionality is remotely reachable. The source bundle does not identify the responsible component, service, port, configuration prerequisites, or fixed release levels, so asset-specific exposure requires comparison with IBM’s advisory.
Exploitation context
The supplied data does not show CISA KEV inclusion or provide evidence of active exploitation or a public exploit. Exploitation is nevertheless potentially severe because the documented attack requires no privileges or user interaction and can occur remotely. Treat absence from KEV as inconclusive, particularly because the disclosure is recent.
Researcher notes
The available evidence establishes CWE-416 and remote arbitrary-code-execution impact but omits the affected component, protocol, root cause details, exploit prerequisites beyond the CVSS vector, and fixed build levels. Researchers should rely on IBM advisory 7283858 for those specifics and avoid assuming all network-accessible AIX or VIOS services are vulnerable.
Mitigation direction
- Review IBM advisory 7283858 for applicable fixes and installation requirements.
- Prioritize remediation on affected systems reachable from untrusted or broadly accessible networks.
- Restrict unnecessary network access to affected systems while remediation is pending.
- Follow IBM guidance for any required service restart, system reboot, or interim mitigation.
- Maintain recoverable backups and change controls before applying vendor fixes.
Validation and detection
- Inventory all IBM AIX 7.2 and 7.3 systems and PowerVM VIOS 4.1 instances.
- Compare installed levels and fixes with IBM advisory 7283858.
- Confirm whether IBM-identified vulnerable functionality is reachable from untrusted networks.
- Verify vendor fixes are installed successfully using IBM-supported checks.
- Review monitoring data for unexplained crashes, service instability, or unauthorized activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-17118 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9ibmVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7283858CVE reference, ibm · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.