IBM Patches 191 Vulnerabilities in AIX and PowerVM VIOS Including Critical Remote Command Execution Flaws
IBM has released security updates to address a large number of vulnerabilities in its AIX UNIX operating system and the PowerVM VIOS virtual I/O server. The issues were detailed in an advisory published on August 15 and include both internally developed code and third-party components.
In total, the company resolved 191 CVEs. According to the Common Vulnerability Scoring System, 35 vulnerabilities carry base scores of 9.0 or higher. Three OS command injection flaws stand out with a score of 9.9: CVE-2026-18835, CVE-2026-16816, and CVE-2026-15068. An additional 23 issues received a score of 9.8.
Affected Products and Fixes
The following AIX releases contain the fixes:
- AIX 7.3 TL04 SP2
- AIX 7.3 TL03 SP3
- AIX 7.3 TL02 SP5
- AIX 7.2 TL05 SP13
For PowerVM VIOS, IBM released versions 4.1.2.20, 4.1.1.30, and 4.1.0.50.
Full List of Addressed CVEs
The complete list of resolved vulnerabilities includes:
- CVE-2025-12817, CVE-2025-12818, CVE-2025-15649, CVE-2026-2003 through CVE-2026-2006, CVE-2026-6472 through CVE-2026-6475, CVE-2026-6477, CVE-2026-6478, CVE-2026-6637, CVE-2026-8368, CVE-2026-8400, CVE-2026-8829, CVE-2026-12087, CVE-2026-14970, CVE-2026-15061, CVE-2026-15065, CVE-2026-15068, CVE-2026-15078, CVE-2026-16243, CVE-2026-16439, CVE-2026-16441, CVE-2026-16656, CVE-2026-16686, CVE-2026-16690, CVE-2026-16703, CVE-2026-16706, CVE-2026-16814, CVE-2026-16816 through CVE-2026-16819, CVE-2026-16821 through CVE-2026-16825, CVE-2026-16827, CVE-2026-16829, CVE-2026-16831, CVE-2026-16833, CVE-2026-16834, CVE-2026-16836 through CVE-2026-16842, CVE-2026-16844 through CVE-2026-16852, CVE-2026-16855, CVE-2026-16857, CVE-2026-16862, CVE-2026-16864 through CVE-2026-16866, CVE-2026-16869, CVE-2026-16872 through CVE-2026-16875, CVE-2026-16877, CVE-2026-16882, CVE-2026-16883, CVE-2026-16885, CVE-2026-16886, CVE-2026-16888, CVE-2026-16890, CVE-2026-16891, CVE-2026-16894, CVE-2026-16897, CVE-2026-16901, CVE-2026-16903, CVE-2026-16909, CVE-2026-16911, CVE-2026-16913, CVE-2026-16914, CVE-2026-16917, CVE-2026-16919, CVE-2026-16922 through CVE-2026-16928, CVE-2026-16932, CVE-2026-16934 through CVE-2026-16937, CVE-2026-16943 through CVE-2026-16946, CVE-2026-16951, CVE-2026-16952, CVE-2026-16958, CVE-2026-16964, CVE-2026-16972, CVE-2026-16973, CVE-2026-16980, CVE-2026-16989, CVE-2026-16991, CVE-2026-16996, CVE-2026-16997, CVE-2026-17000, CVE-2026-17003, CVE-2026-17006, CVE-2026-17007, CVE-2026-17009, CVE-2026-17024, CVE-2026-17040, CVE-2026-17060, CVE-2026-17118, CVE-2026-17120 through CVE-2026-17122, CVE-2026-17124, CVE-2026-17136, CVE-2026-17138, CVE-2026-17141, CVE-2026-17142, CVE-2026-17145, CVE-2026-17152, CVE-2026-17157, CVE-2026-17159, CVE-2026-17160, CVE-2026-17163, CVE-2026-17165, CVE-2026-17168, CVE-2026-17170, CVE-2026-17171, CVE-2026-17195, CVE-2026-17422 through CVE-2026-17425, CVE-2026-17436, CVE-2026-18670, CVE-2026-18716, CVE-2026-18822, CVE-2026-18824, CVE-2026-18828, CVE-2026-18832, CVE-2026-18835, CVE-2026-18840, CVE-2026-18842, CVE-2026-19437, CVE-2026-19442, CVE-2026-19446, CVE-2026-19448, CVE-2026-19449, CVE-2026-19653, CVE-2026-19783, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-41254, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47057 through CVE-2026-47059, CVE-2026-47063, CVE-2026-48959, CVE-2026-48962, CVE-2026-59995 through CVE-2026-59997, CVE-2026-59999 through CVE-2026-60002, CVE-2026-60147
Administrators are advised to apply the listed updates as soon as possible to mitigate the highest-risk issues.
Related articles
Microsoft Patches Two BitLocker Vulnerabilities Allowing Encryption Bypass via Physical Access
Microsoft released fixes on November 10, 2026, for two BitLocker vulnerabilities that enable attackers with physical access to bypass disk encryption on Windows systems. CVE-2026-119832 carries a CVSS score of 5.9 and stems from an improperly applied access control, allowing low-privileged local users to read protected data from the system drive without user interaction. CVE-2026-97015 scores 6.8 and involves a buffer overflow in dynamically allocated memory, requiring no prior privileges and classified as low attack complexity. Both flaws affect Windows 10 versions 1809, 21H2 and 22H2, multiple Windows 11 releases, and Windows Server 2019, 2022 and 2025 editions across various processor platforms. The issues directly undermine BitLocker's core purpose of protecting lost, stolen or improperly decommissioned devices. Corresponding updates include KB5131096 for Windows 10 21H2/22H2 and KB5131087 for Windows 11 23H2, with administrators advised to verify coverage for CVE-2026-97015 separately.
Qlik Sense Servers Targeted with Reverse Shell Attacks in October 2026 Campaign
In October 2026, multiple Qlik Sense servers hosted by European Union customers were subjected to attempted reverse shell installations within a three-minute window. The attacks were blocked before execution and originated from a single-line PowerShell command delivered through the Qlik Sense scheduling component. Analysts noted strong similarities to a November 2023 campaign attributed to CACTUS ransomware operators that exploited three specific vulnerabilities: CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. The observed activity included a Go-based second-stage payload that searched for Apache ActiveMQ processes, harvested local account hashes on Linux, and deployed modified OpenSSH servers for persistence. Infrastructure recovered during the investigation also contained exploits for a 2023 Apache ActiveMQ vulnerability and a 2024 Veeam Backup and Replication flaw, indicating broader targeting intentions. The root vulnerability exploited in the 2026 attempts remains unidentified.
Ivanti Patches 13 Vulnerabilities in Five Products, Including Two Critical Flaws
Ivanti has issued security updates for five enterprise products to address a total of 13 vulnerabilities, two of which carry a critical severity rating. The affected products include Ivanti Endpoint Manager, Ivanti Cloud Services Application, Ivanti Sentry, Ivanti Endpoint Manager Mobile, and Ivanti User Workspace Manager. The most severe issues allow unauthenticated remote code execution and unauthorized certificate manipulation. One critical flaw, CVE-2026-121653, affects the Core component of Ivanti EPM and scores 9.8 on CVSS v3.0. A second critical vulnerability, CVE-2026-121683, impacts Ivanti CSA version 5.0.8 and enables arbitrary addition or deletion of certificate registration data. The remaining vulnerabilities are rated high and affect multiple other Ivanti solutions.
Google Issues Second Chrome Update This Week, Patching 83 Vulnerabilities Including Five Critical Flaws
Google has released a new security update for its Chrome browser, marking the second release within the same week. The update addresses a total of 83 vulnerabilities across Windows, macOS, and Linux platforms. Five of these issues are rated Critical and involve Use After Free memory errors in key components such as ServiceWorker, CSS, Layout, Skia, and Accessibility. The previous update from November 9 fixed nine vulnerabilities, one of which (CVE-2026-125350) had already been observed in active exploitation. No evidence of in-the-wild exploitation has been reported for the latest set of fixes. The new versions are Chrome 157.0.8103.79 for Windows and macOS and 157.0.8103.78 for all three operating systems.