Quick answers
- Is CVE-2026-17424 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-17424 being exploited in the wild.
- How severe is CVE-2026-17424?
- Medium severity, with a CVSS score of 4.8, published 20 August 2026.
- Which products and versions are affected?
- IBM Aix 7.2, 7.3; IBM PowerVM VIOS 4.1.
- Is there a fix for CVE-2026-17424?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-17424 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-17424?
- Check whether you run IBM Aix or IBM PowerVM VIOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-17424 is a pathname validation vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows remote attackers to bypass security restrictions due to improper limitation of pathname access to restricted directories. The vulnerability can be exploited over the network without authentication. An attacker can exploit this flaw to circumvent directory access controls and potentially gain unauthorized access to sensitive files or operations. Patches are available through IBM service packs and fix packs for supported releases.
Affected products
- IBM AIX 7.2, 7.3
- IBM PowerVM VIOS 4.1
Timeline
- 2026-08-20: disclosed
- 2026-08-21: advisory: IBM security bulletin updated with installation instructions