IBM Power Systems Firmware BMC Interface Missing Authorization Vulnerability (CVE-2026-16930)

Vulnerability Overview CVE ID: CVE-2026-16930 Description: Power Systems Firmware contains a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access can execute arbitrary code on the host system, resulting in complete control over the host system and all managed partitions, impacting confidentiality, integrity, and availability. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base Score: 8.2 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Scope Affected Firmware Versions: - FW1120.00 - FW1110.00 - FW1110.30 - FW1060.00 - FW1060.80 Affected Hardware Models: - IBM Power System E1180 (9080-HEU) - IBM Power System S1122 (9824-22A) - IBM Power System S1124 (9824-42A) - IBM Power System S1122s (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1122 (9856-22H) - IBM Power System L1124 (9856-42H) - IBM Power System E1150 (9043-MRU) - IBM Power System S1112 (9242-21B, 9242-21T) - IBM Power System E1080 (9080-HEX) - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022s (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) Remediation Fixed Versions: - For Power 11 systems, install FW1110.31(1110_134), FW1120.01(1120_167), or later. - For Power 10 systems, install FW1060.81(1060_184) or later. Additional Information Workarounds: None References: - Complete CVSS v3 Guide - Online Calculator v3 Disclaimer As defined by the FIRST organization, CVSS is an industry standard used to communicate vulnerability severity and response priority. IBM provides CVSS scores "as is," without any expressed or implied warranties. IBM is not responsible for assessing the impact of any actual or potential security vulnerabilities. IBM regularly updates component records within its product portfolio but does not certify that the referenced products have been used by IBM since the date of the record, nor does it certify that IBM was aware of the vulnerability at the time it was issued. IBM is striving to inform customers about relevant vulnerabilities as they become more aware. The referenced "Affected Products and Versions" refer only to IBM-supported and non-retired products and versions. Therefore, the exclusion of unsupported or extended-support products and versions from this security announcement does not constitute IBM's determination that they are unaffected by the vulnerability. The inclusion of one or more unsupported versions in this security announcement does not constitute an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware BMC Interface Missing Authorization Vulnerability (CVE-2026-16930)

More from this source