IBM Power System Firmware CVE-2026-16828 Security Advisory

Security Advisory: This Power System update is being released to address CVE-2026-16828 Vulnerability Overview Power Systems firmware is affected by a vulnerability in the ASMI network interface. An unauthenticated attacker on the management network may cause the ASMI network server to crash, potentially resulting in memory corruption and the generation of error logs; the host partition is not affected. The ASMI network interface will automatically restart; however, repeated exploitation may result in a loss of continuous access to the ASMI management interface, leading to integrity and availability impacts. Scope of Impact CVEID: CVE-2026-16828 Description: Power Systems firmware is affected by a vulnerability in the ASMI network interface. An unauthenticated attacker on the management network may cause the ASMI network server to crash, potentially resulting in memory corruption and the generation of error logs; the host partition is not affected. The ASMI network interface will automatically restart; however, repeated exploitation may result in a loss of continuous access to the ASMI management interface, leading to integrity and availability impacts. CWE: CWE-125: Out-of-bounds Read CVSS Source: IBM CVSS Base Score: 7.6 CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Affected Products and Versions Remediation Power 11: Install FW1120.01(1120_167), FW1110.31(1110_134) or later to fix this vulnerability. - IBM Power System E1180 (9080-HEU) Power 10: Install FW1060.81(1060_184) or later to fix this vulnerability. - IBM Power System E1080 (9080-HEX) Power 9: Install FW950.H3(950_230) or later to fix this vulnerability. - IBM Power System S922 (9009-22G) - IBM Power System S922 (9223-22S) - IBM Power System S914 (9009-41G) - IBM Power System S924 (9009-42G) - IBM Power System H924 (9223-42S) - IBM Power System E950 (9040-MR9) - IBM Power System E980 (9080-M9S) Workarounds and Mitigations Protect the FSP network interface. References Complete CVSS v3 Guide Online Calculator v3 Related Information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments None Change History August 15, 2026: Initial release Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard that aims to communicate vulnerability severity and help prioritize response efforts." IBM provides CVSS scores "as is," without any express or implied warranties, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. Furthermore, IBM periodically updates the records of components included in its products. As part of this work, IBM may identify previously unidentified packages, regardless of their CVE dates. The inclusion of an older CVEID does not prove that IBM has been using the referenced product since that date, nor does it prove that IBM knew of the vulnerability prior to that date. We are committed to keeping customers informed of relevant vulnerabilities. As they become aware of them, IBM Security Advisories aim to list only those products and versions that are supported by IBM and have not passed their end of support or warranty dates. Therefore, the failure to list unsupported or extended support products and versions in this Security Advisory does not constitute IBM's determination that they are unaffected by the vulnerability. The listing of one or more unsupported versions in this Security Advisory does not create an obligation for IBM to fix any unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power System Firmware CVE-2026-16828 Security Advisory

More from this source