CVE-2026-15961

Power System Information Disclosure

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 37 more

CVE-2026-17093

Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power Hardware Management Console \(7063-cr2\) Power Hardware Management Console \(7063-cr2\) Firmware Power System Ac922 \(8335-gth\) and 56 more

CVE-2026-17100

Power System Out-of-bounds Write

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 - OP940.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power Firmware Power Hardware Management Console \(7063-cr2\) Power Hardware Management Console \(7063-cr2\) Firmware and 57 more

CVE-2026-17429

Power System Incorrect Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power Hardware Management Console \(7063-cr2\) Power Hardware Management Console \(7063-cr2\) Firmware Power System Ac922 \(8335-gth\) and 56 more

CVE-2026-17494

Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1150 \(9043-mru\) Power System E1150 \(9043-mru\) Firmware Power System E1180 \(9080-heu\) and 18 more

CVE-2026-18681

This Power System Buffer Overflow

IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-18848

Power System Cross-Site Request Forgery (CSRF)

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-19321

Power System Integer Overflow

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful exploitation could result in limited confidentiality or availability impacts to the affected host system.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 36 more

CVE-2026-16661

Power System Integer Overflow

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 51 more

CVE-2026-16707

Power System Out-of-bounds Read

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 51 more

CVE-2026-19448

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-16724

Power System Integer Overflow

IBM Virtualization Management Interface FW1110.00 through FW1110.30, FW1120.00 through FW1120.00, and FW1060.00 through FW1060.80 is affected by a vulnerability in the Virtualization Management Interface (VMI). An attacker with authenticated administrator-level access can cause the VMI to crash. The VMI will restart automatically; however, repeated exploitation could result in a sustained availability impact.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1150 \(9043-mru\) and 33 more

CVE-2026-16828

Power System Out-of-bounds Read

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory corruption and generate an error log; hosted partitions are not affected. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-17171

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-18840

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-18842

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an out-of-bounds write.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-19442

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios

CVE-2026-16832

Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-16835

Power System Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-16926

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aix Powervm Vios Vios