PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8972 IBM CVE debrief

CVE-2016-8972 is a local privilege-escalation issue in IBM AIX bellmail that could allow a local user to gain root privileges by using a specially crafted command. IBM’s advisory references APARs IV91006, IV91007, IV91008, IV91010, and IV91011. NVD published the record on 2017-02-15 and rates it High severity (CVSS 7.8).

Vendor
IBM
Product
Vios
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

AIX administrators, system owners, and security teams responsible for multi-user IBM Unix environments should prioritize this issue, especially where local shell access is possible. Teams managing IBM VIOS instances should also review NVD’s mapped CPE coverage.

Technical summary

The supplied description states that IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges through a specially crafted command in the bellmail client. The NVD record assigns CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and CWE-264. In addition to the AIX versions named in the description, NVD’s CPE criteria also list multiple IBM VIOS versions as vulnerable.

Defensive priority

High. This is a local root privilege-escalation issue with full confidentiality, integrity, and availability impact once a local foothold exists.

Recommended defensive actions

  • Review IBM’s advisory referenced by NVD and apply the vendor-provided fix packages or APAR remediation for the affected AIX releases.
  • Confirm whether any systems run the bellmail client or related AIX mail tooling, and reduce local access where it is not required.
  • Audit AIX and VIOS estates against the NVD CPE coverage to identify in-scope versions.
  • Prioritize patching on systems with shared accounts, administrative operators, or any untrusted local users.
  • Validate remediation by checking installed fix levels against IBM guidance before returning systems to service.

Evidence notes

All factual claims are drawn from the supplied NVD record and its referenced IBM advisory metadata. The record states AIX 6.1/7.1/7.2 are affected, identifies a local command-triggered root escalation path in bellmail, and lists IBM APARs IV91006, IV91007, IV91008, IV91010, and IV91011. NVD also includes IBM VIOS CPE entries and the CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8972 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8972

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8972 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8972

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.