IBM Power Systems Firmware Config Parsing Vulnerability (CVE-2026-17093)

Vulnerability Overview CVE Number: CVE-2026-17093 Description: A vulnerability exists in the parsing of host firmware configuration in Power Systems Firmware. An attacker can provide specially crafted configuration data via BMC/FSP to disrupt the host firmware boot process and subsequently loaded content, thereby impacting the confidentiality, integrity, and availability of the managed system. CVSS Score: 8.2 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Affected Products Affected Products: - Power Firmware FW1120.00 - Power Firmware FW1110.00 - FW1110.30 - Power Firmware FW1060.00 - FW1060.80 - Power Firmware FW950.00 - FW950.H2 - Power Firmware OP940.00 - OP940.a1 (Power9) - Power Firmware OP940.00 - OP940.B1 (Power HMC) Remediation Power 11: - Install FW1110.31(1110_134) or FW1120.01(1120_167) or later versions. - Specific products include: IBM Power System E1180 (9080-HEU), IBM Power System S1122 (9824-22A), IBM Power System S1124 (9824-42A), IBM Power System S1122s (9824-22B), IBM Power System S1114 (9824-41B), IBM Power System L1122 (9856-22H), IBM Power System L1124 (9856-42H), IBM Power System E1150 (9043-MRU), IBM Power System S1112 (9242-21B, 9242-21T). Power 10: - Install FW1060.81(1060_184) or later versions. - Specific products include: IBM Power System E1080 (9080-HEX), IBM Power System S1022 (9105-22A), IBM Power System S1024 (9105-42A), IBM Power System S1022s (9105-22B), IBM Power System S1014 (9105-41B), IBM Power System L1022 (9786-22H), IBM Power System L1024 (9786-42H), IBM Power System E1050 (9043-MRX), IBM Power System S1012 (9028-21B). Power 9: - Install FW950.H3(950_230) or later versions. - Specific products include: IBM Power System S922 (9009-22G), IBM Power System H922 (9223-22S), IBM Power System S914 (9009-41G), IBM Power System S924 (9009-42G), IBM Power System H924 (9223-42S), IBM Power System E950 (9040-MR9), IBM Power System E980 (9080-M9S). Power Hardware Management Console: - Install OP940.a2 or later versions. - Specific products include: IBM Power Hardware Management Console (7063-CR2). Additional Information Workarounds and Mitigations: None. References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey vulnerability severity and response priority. IBM provides CVSS scores "as is" and offers no express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their own environments. IBM regularly updates product component records but does not guarantee that all vulnerabilities are covered. Change History August 15, 2026: Initial release.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware Config Parsing Vulnerability (CVE-2026-17093)

More from this source