IBM Power Systems Firmware NVRAM Parsing Vulnerability (CVE-2026-17042)

Vulnerability Overview CVE ID: CVE-2026-17042 Description: Power Systems Firmware is affected by a host firmware NVRAM parsing vulnerability. An attacker can cause a crash during the host firmware boot process and potentially trigger memory corruption by writing a crafted NVRAM image on an OpenPOWER system. Restoring normal operation requires operator intervention (clearing NVRAM via the service processor). Impact: This vulnerability affects only OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation compromises the integrity and availability of the managed system. Affected Versions Affected Firmware Versions: - Power Firmware: FW950.00 - FW950.H2 - Power Firmware: OP940.00 - OP940.a1 (Power9) - Power Firmware: OP940.00 - OP940.81 (Power HMC) Remediation Power 9: - Install FW950.H3 (950_230) or later to remediate this vulnerability. - Install OP940.a2 or later to remediate this vulnerability. - Install OP940.82 or later to remediate this vulnerability. Specific Products: - IBM Power System S922 (9009-22G) - IBM Power System H922 (9223-22S) - IBM Power System S914 (9009-41G) - IBM Power System S924 (9009-42G) - IBM Power System H924 (9223-42S) - IBM Power System E950 (9040-MR9) - IBM Power System E980 (9080-M9S) - IBM Power System AC922 (8335-GTH, 8335-GTX) - IBM Power Hardware Management Console (7063-CR2) Additional Information CVSS Score: 7.3 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/E:L/A:H) References: - Complete CVSS v3 Guide - Online Calculator v3 Disclaimer As defined by the FIRST organization, CVSS is an industry standard used to communicate vulnerability severity and help determine response priority. IBM provides CVSS scores "as is" and offers no warranties, either express or implied. IBM periodically updates its product component records; referencing an older CVE ID does not indicate that IBM has used that referenced product since that date, nor does it indicate that IBM was aware of the vulnerability at the time of its disclosure. While IBM strives to keep customers informed of relevant vulnerabilities, the "Affected Products and Versions" refer only to products and versions supported and maintained by IBM. Therefore, the omission of unsupported or Extended Support products and versions from this security bulletin does not constitute an obligation for IBM to provide a fix for those unsupported or Extended Support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Power Systems Firmware NVRAM Parsing Vulnerability (CVE-2026-17042)