A. APARS

IBM has assigned the following APARs to this problem:

AIX Level	APAR	Availability	SP	KEY
7.2.5	IJ59566	08/14/2026	SP13	key_w_apar
7.3.2	IJ59565	08/14/2026	SP05	key_w_apar
7.3.3	IJ59564	08/14/2026	SP03	key_w_apar
7.3.4	IJ59563	08/14/2026	SP02	key_w_apar

VIOS Level	APAR	Availability	SP	KEY
4.1.0	IJ59565	08/14/2026	4.1.0.50	key_w_apar
4.1.1	IJ59564	08/14/2026	4.1.1.30	key_w_apar
4.1.2	IJ59563	08/14/2026	4.1.2.20	key_w_apar

B. FIXES

IBM strongly recommends addressing the vulnerability now.

AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral

An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.

IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.

AIX Level	Service Pack
AIX 7.3 TL04	SP2
AIX 7.3 TL03	SP3
AIX 7.3 TL02	SP5
AIX 7.2 TL05	SP13

PowerVM VIOS Level	Fix Pack
VIOS 4.1.2	4.1.2.20
VIOS 4.1.1	4.1.1.30
VIOS 4.1.0	4.1.0.50

Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .

Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:
https://www.ibm.com/support/pages/node/7283157

Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:

4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819
4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

CVE-2026-16885

Credits

References