CVE-2026-18849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18849", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-04T15:35:55.877Z", "datePublished": "2026-08-19T20:21:55.706Z", "dateUpdated": "2026-08-21T16:13:25.891Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-19T20:21:55.706Z"}, "title": "IBM OpenBMC Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "OPENBMC", "versions": [{"status": "affected", "version": "FW1060.00", "lessThanOrEqual": "FW1060.80", "versionType": "semver"}], "cpes": ["cpe:2.3:o:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:openbmc:fw1060.80:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283590", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "Protect access to the BMC's administrative interface.\u00a0 Install firmware images only from trusted sources.\u00a0 Validate the firmware image's integrity as described in the firmware \"Release Notes\" section \"Firmware Information and Description\" before installing it.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Protect access to the BMC's administrative interface.\u00a0 Install firmware images only from trusted sources.\u00a0 Validate the firmware image's integrity as described in the firmware \"Release Notes\" section \"Firmware Information and Description\" before installing it.</p>"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1060.81(1060_191) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Customers with the products below should install FW1060.81(1060_191) or newer to remediate this vulnerability.</p><p>Power 10<br/>1) IBM Power System S1022 (9105-22A)<br/>2) IBM Power System S1024 (9105-42A)<br/>3) IBM Power System S1022s (9105-22B)<br/>4) IBM Power System S1014 (9105-41B)<br/>5) IBM Power System L1022 (9786-22H)<br/>6) IBM Power System L1024 (9786-42H)<br/>7) IBM Power System E1050 (9043-MRX)<br/>8) IBM Power System S1012 (9028-21B)</p><p>The images mentioned above can be located at IBM Fix Central : <a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/</a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T16:09:43.502126Z", "id": "CVE-2026-18849", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:13:25.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T16:09:43.502126Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:13:19.830Z"}}], "cna": {"title": "IBM OpenBMC Code Execution", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:o:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:openbmc:fw1060.80:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "OPENBMC", "versions": [{"status": "affected", "version": "FW1060.00", "versionType": "semver", "lessThanOrEqual": "FW1060.80"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1060.81(1060_191) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "value": "<p>Customers with the products below should install FW1060.81(1060_191) or newer to remediate this vulnerability.</p><p>Power 10<br/>1) IBM Power System S1022 (9105-22A)<br/>2) IBM Power System S1024 (9105-42A)<br/>3) IBM Power System S1022s (9105-22B)<br/>4) IBM Power System S1014 (9105-41B)<br/>5) IBM Power System L1022 (9786-22H)<br/>6) IBM Power System L1024 (9786-42H)<br/>7) IBM Power System E1050 (9043-MRX)<br/>8) IBM Power System S1012 (9028-21B)</p><p>The images mentioned above can be located at IBM Fix Central : <a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283590", "tags": ["vendor-advisory", "patch"]}], "workarounds": [{"lang": "en", "value": "Protect access to the BMC's administrative interface.\u00a0 Install firmware images only from trusted sources.\u00a0 Validate the firmware image's integrity as described in the firmware \"Release Notes\" section \"Firmware Information and Description\" before installing it.", "supportingMedia": [{"type": "text/html", "value": "<p>Protect access to the BMC's administrative interface.\u00a0 Install firmware images only from trusted sources.\u00a0 Validate the firmware image's integrity as described in the firmware \"Release Notes\" section \"Firmware Information and Description\" before installing it.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-19T20:21:55.706Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18849", "state": "PUBLISHED", "dateUpdated": "2026-08-21T16:13:25.891Z", "dateReserved": "2026-08-04T15:35:55.877Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-08-19T20:21:55.706Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:openbmc:fw1060.80:*:*:*:*:*:*:*"], "product": "OPENBMC", "vendor": "IBM", "versions": [{"lessThanOrEqual": "FW1060.80", "status": "affected", "version": "FW1060.00", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:openbmc:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E4898E2-7516-4F81-92C7-31B8EC891178", "versionEndIncluding": "fw1060.80", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "061D193E-84BC-4DE7-96C4-B75D11769ED5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "B2C09090-C18F-464A-8DEF-E23B5990E2A4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "0170400B-89A7-4B44-9AA7-9A168C9CAE9C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0524365D-8379-4B10-B9C5-FF80EE84BA27", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "7BED85F2-8CCB-417C-A739-23828966A036", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "41572D5A-C3A2-4294-9AF9-D4824675B4A3", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "ECD54B80-5754-4C19-AE0C-F539DEF96DCB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0BB54554-C9DC-4072-A205-EA9DD4E15688", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "E3E15C41-9CBD-4F66-A176-07B3E9BBD81D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "51C2576F-E4DD-4002-9E41-CF89F92E2064", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "564A665A-7B94-40CE-A4D9-CDD0CCF52B2E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA4B835D-CEAB-422B-9F38-F63AF84396C3", "versionEndExcluding": "fw1060.81", "versionStartIncluding": "fw1060.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "E49EE658-B8AE-48F7-A765-92BA3A630AA0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact."}], "id": "CVE-2026-18849", "lastModified": "2026-09-02T18:58:30.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18849", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T16:09:43.502126Z", "version": "2.0.3"}}]}, "published": "2026-08-19T21:16:54.663", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7283590"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[FW1060.00,FW1060.80]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OPENBMC", "source": "cna", "vendor": "IBM"}, "product": "openbmc", "vendor": "ibm"}], "created": "2026-08-19T22:00:07.945260+00:00", "updated": "2026-08-20T11:30:16.513725+00:00", "vendors": ["ibm", "ibm$PRODUCT$openbmc"]}