CVE-2026-16832 PUBLISHED

Power System Buffer Overflow

Assigner: ibm
Reserved: 24.07.2026 Published: 19.08.2026 Updated: 19.08.2026

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.4

Product Status

Vendor IBM
Product Power Systems Firmware
Versions
  • Version FW1120.00 is affected
  • affected from FW1110.00 to FW1110.30 (incl.)
  • affected from FW1060.00 to FW1060.80 (incl.)
  • affected from FW950.00 to FW950.H2 (incl.)

Workarounds

Protect access to the FSP's network interface.

Solutions

Customers with the products below should install FW1120.01(1120_167), FW1110.31(1110_134), or newer to remediate this vulnerability.

Power 11 1) IBM Power System E1180 (9080-HEU)

Customers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.

Power 10 1) IBM Power System E1080 (9080-HEX)

Customers with the products below should install FW950.H3(950_230), or newer to remediate this vulnerability.

Power9 1) IBM Power System S922 (9009-22G) 2) IBM Power System H922 (9223-22S) 3) IBM Power System S914 (9009-41G) 4) IBM Power System S924 (9009-42G) 5) IBM Power System H924 (9223-42S) 6) IBM Power System E950 (9040-MR9) 7) IBM Power System E980 (9080-M9S)

The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/

References

Problem Types

  • CWE-121 Stack-based Buffer Overflow CWE