IBM Power Systems Firmware Hardware Register Info Disclosure (CVE-2026-19321)

Vulnerability Overview CVE ID: CVE-2026-19321 Description: A vulnerability exists in Power Systems Firmware that allows an attacker to send crafted commands via the service processor to the host firmware. This can lead to the disclosure of hardware register contents that are intended to be inaccessible to the service processor. Successful exploitation may result in a limited impact on the confidentiality or availability of the host system. CWE: CWE-190: Integer Overflow or Wraparound CVSS Score: 6.7 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) Affected Products Affected Firmware Versions: - Power Firmware FW1120.00 - Power Firmware FW1110.00 - FW1110.30 - Power Firmware FW1060.00 - FW1060.80 Affected Systems: - IBM Power System E180 (9080-HEU) - IBM Power System S1122 (9824-22A) - IBM Power System S1124 (9824-42A) - IBM Power System S1122s (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1122 (9856-22H) - IBM Power System L1124 (9856-42H) - IBM Power System E1150 (9043-MRU) - IBM Power System S1112 (9242-21B, 9242-21T) - IBM Power System E1080 (9080-HEX) - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022s (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) Remediation Fix Versions: - For Power 11 systems, install FW1110.31 (1110_134), FW1120.01 (1120_167), or a later version. - For Power 10 systems, install FW1060.81 (1060_184) or a later version. Additional Information Workaround: If performing a concurrent upgrade, the system must be restarted after updating to the new firmware level to mitigate this vulnerability. References: - Complete CVSS v3 Guide - On-line Calculator v3 Disclaimer The Forum of Incident Response and Security Teams (FIRST) states that the Common Vulnerability Scoring System (CVSS) is an "industry open standard" intended to communicate vulnerability severity and help determine the urgency and priority of response. IBM provides CVSS scores "as is," without any express or implied warranties, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM periodically updates component records included in its product offerings. As part of this effort, IBM identifies previously unrecognized packages within product and service inventories; regardless of the CVE date, IBM addresses related vulnerabilities. The inclusion of an earlier CVE ID does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was unaware of the vulnerability prior to that date. We strive to keep customers informed of vulnerabilities known to IBM. The referenced "Affected Products and Versions" are intended to include only products and versions that are supported and not out of support by IBM. Therefore, referencing unsupported or extended support products and versions does not constitute IBM's determination that they are unaffected by the vulnerability. Referencing one or more unsupported versions in this security bulletin does not create any remediation obligation for IBM for those unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware Hardware Register Info Disclosure (CVE-2026-19321)

More from this source