IBM Power Systems Firmware FSP Management Network Unauthorized Access Vulnerability (CVE-2026-16835) Advisory

Vulnerability Overview CVE ID: CVE-2026-16835 Description: A vulnerability exists in the FSP management network protocol within Power Systems Firmware. An unauthenticated attacker can bypass authentication via the management network and perform any administrative operation, including controlling partition power states, configuring, and accessing the consoles of all managed partitions, thereby impacting confidentiality, integrity, and availability. CVSS Base Score: 9.6 CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected Products Affected Products and Versions: - Power 11: - IBM Power System E1180 (9080-HEU) - Power 10: - IBM Power System E1080 (9080-HEX) - Power 9: - IBM Power System S922 (9009-22G) - IBM Power System S922 (9223-22S) - IBM Power System S914 (9009-41G) - IBM Power System S924 (9009-42G) - IBM Power System S924 (9223-42S) - IBM Power System E950 (9040-MR9) - IBM Power System E980 (9080-M9S) Remediation Power 11: - Install FW1120.01(1120_167) or FW1110.31(1110_134), or a newer version. Power 10: - Install FW1060.81(1060_184), or a newer version. Power 9: - Install FW950.H3(950_230), or a newer version. Mitigations Protect the FSP network interface. References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" without any express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their specific environments. IBM regularly updates the component records included in its product portfolio and addresses related vulnerabilities when previously unidentified packages are identified, regardless of the CVE date. The referenced "Affected Products and Versions" refer only to IBM-supported products and versions within their end-of-support or warranty periods. Therefore, vulnerability announcements that do not reference unsupported or extended-support products and versions do not constitute a determination by IBM that IBM is unaffected by those vulnerabilities. Vulnerability announcements citing one or more unsupported versions do not impose any obligation on IBM to fix any unsupported or extended-support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware FSP Management Network Unauthorized Access Vulnerability (CVE-2026-16835) Advisory

More from this source