IBM Power Systems Firmware RCE Vulnerability Advisory (CVE-2026-16661)

Vulnerability Overview CVE ID: CVE-2026-16661 Description: A vulnerability exists in the service processor mail interface of Power Systems Firmware. An attacker with authenticated service-level access can exploit this vulnerability to execute arbitrary code during host firmware runtime, thereby gaining full control of the managed system and resulting in impacts to confidentiality, integrity, and availability. CVSS Score: 8.2 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Impact Scope Affected Products and Versions: - PowerVM Hypervisor: FW1120.00 - PowerVM Hypervisor: FW1110.00 - FW1110.30 - PowerVM Hypervisor: FW1060.00 - FW1060.80 - PowerVM Hypervisor: FW950.00 - FW950.H2 Remediation Remediation Versions: - For the following products, it is recommended to install FW1110.31(1110_134), FW1120.01(1120_167), or a later version to remediate this vulnerability: - IBM Power System E1180 (9080-HEU) - For the following products, it is recommended to install FW1110.31(1110_155), FW1120.01(1120_190), or a later version to remediate this vulnerability: - IBM Power System S1122 (9824-22A) - IBM Power System S1124 (9824-42A) - IBM Power System S1122s (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1122 (9856-22H) - IBM Power System L1124 (9856-42H) - IBM Power System E1150 (9043-MRU) - For the following products, it is recommended to install FW1120.01(1120_190), or a later version to remediate this vulnerability: - IBM Power System S1112 (9242-21B, 9242-21T) - For the following products, it is recommended to install FW1060.81(1060_184), or a later version to remediate this vulnerability: - IBM Power System E1080 (9080-HEX) - For the following products, it is recommended to install FW1060.81(1060_191), or a later version to remediate this vulnerability: - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022s (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) - For the following products, it is recommended to install FW950.H3(950_230), or a later version to remediate this vulnerability: - IBM Power System S922 (9009-22G) - IBM Power System H922 (9223-22S) - IBM Power System S914 (9009-41G) - IBM Power System S924 (9009-42G) - IBM Power System H924 (9223-42S) - IBM Power System E950 (9040-MR9) - IBM Power System E980 (9080-M9S) Additional Information Workarounds and Mitigations: None References: - Completing the CVSS v3 Guide - Online Calculator v3 Related Resources: - IBM Security Engineering Web Portal - IBM Security Incident Response Blog Disclaimer As defined by FIRST and CVSS, the CVSS score provided by IBM is for reference purposes only and does not constitute any warranty. Customers are responsible for evaluating the impact of the vulnerability on their own environments. Document Location Global Document Information Last Modified: August 15, 2026 Initial Publication Date: August 15, 2026 UID: ibm1728237 Feedback Was this topic helpful? Need support? Submit feedback to IBM Support Contact: 1-800-IBM-7378 (USA) Global Contact Directory

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware RCE Vulnerability Advisory (CVE-2026-16661)