Security readout for executives and security teams
Plain-English summary
A flaw in supported IBM AIX and PowerVM VIOS versions may let an unauthenticated remote attacker run arbitrary code. Successful exploitation could expose sensitive data, alter systems, or interrupt critical workloads. The 9.8 CVSS rating warrants urgent attention, although the supplied sources do not establish active exploitation.
Executive priority
Treat this as an immediate remediation priority because compromise could affect critical infrastructure and hosted workloads without authentication or user interaction. Require rapid asset identification, IBM-guided patch planning, temporary exposure reduction, and tracked exceptions. Urgency is driven by technical severity, not confirmed active exploitation.
Technical view
CVE-2026-17122 is a stack-based buffer overflow, classified as CWE-787, affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. Its CVSS 3.1 vector indicates network reachability, low attack complexity, no required privileges or user interaction, unchanged scope, and potentially complete confidentiality, integrity, and availability impact.
Likely exposure
Exposure exists where the listed AIX or VIOS versions are deployed and the vulnerable network-accessible component is reachable. Systems accessible from untrusted or broadly connected networks deserve first attention. The supplied bundle does not identify the affected service, port, configuration prerequisites, or specific fixed levels.
Exploitation context
The CVSS vector describes a remotely reachable, unauthenticated vulnerability requiring no user action and having low attack complexity. However, the bundle marks it absent from KEV and provides no cited evidence of exploitation in the wild, public proof-of-concept availability, or weaponization.
Researcher notes
The public bundle establishes affected product families, major versions, CWE-787, and CVSS 9.8. It does not identify the vulnerable daemon, protocol, port, triggering input, vulnerable function, exact maintenance levels, APAR identifiers, or fixed builds. Consult IBM advisory 7283858 before making version-specific remediation or detection claims.
Mitigation direction
- Inventory AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 deployments immediately.
- Review IBM advisory 7283858 for applicable fixes, prerequisites, and installation guidance.
- Apply IBM-provided remediation using normal testing and change-control procedures.
- Restrict unnecessary network reachability while remediation is pending.
- Prioritize internet-facing and broadly accessible management infrastructure.
Validation and detection
- Confirm installed AIX and VIOS versions across physical and virtual infrastructure.
- Identify network paths reaching affected systems from untrusted or broad internal segments.
- Map IBM advisory guidance to each system's exact maintenance level.
- Verify IBM remediation is installed successfully on every affected asset.
- Re-scan inventories and document any exceptions or deferred systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-17122 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9ibmVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7283858CVE reference, ibm · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.