IBM PowerVM Firmware Image Verification Bypass Allows Arbitrary Code Execution (CVE-2026-96263)

Vulnerability Overview Vulnerability ID: CVE-2026-96263 Vulnerability Description: Power Systems Firmware contains a vulnerability in the host firmware boot image verification path. An attacker with service processor access can provide a maliciously crafted code update image, allowing arbitrary code execution on the host system. Successful exploitation may result in impacts to the confidentiality, integrity, and availability of the host system. CVSS Base Score: 8.2 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Affected Products Affected Products: - PowerVM Hypervisor FW1120.00 - FW1120.01 - PowerVM Hypervisor FW1110.00 - FW1110.31 - PowerVM Hypervisor FW1060.00 - FW1060.83 Remediation Remediation Version: - For the following products, install FW1110.32(1110_138), FW1120.02(1120_171), or a later version to remediate this vulnerability: - Power 11 - IBM Power System E1180 (9080-HEU) - Power 11 - IBM Power System S1122 (9824-22A) - IBM Power System S1124 (9824-42A) - IBM Power System S1122s (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1122 (9856-22H) - IBM Power System L1124 (9856-42H) - IBM Power System E1150 (9043-MRU) - Power 11 - IBM Power System S1112 (9242-21B, 9242-21T) - For the following products, install FW1060.82(1060_189) or a later version to remediate this vulnerability: - Power 10 - IBM Power System E1080 (9080-HEX) - For the following products, install FW1060.82(1060_199) or a later version to remediate this vulnerability: - Power 10 - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022s (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) Workarounds and Mitigations: - Note: If performing a concurrent upgrade, the system must be restarted after updating to the new firmware level to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

IBM PowerVM Firmware Image Verification Bypass Allows Arbitrary Code Execution (CVE-2026-96263)

More from this source