CVE-2026-96266

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96266", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-09-22T20:16:36.007Z", "datePublished": "2026-10-12T20:51:56.396Z", "dateUpdated": "2026-10-13T11:57:49.892Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-10-12T20:51:56.396Z"}, "title": "IBM Power Systems Firmware Buffer Overflow", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "PowerVM Hypervisor", "versions": [{"status": "affected", "version": "FW1060.00", "lessThanOrEqual": "FW1060.81", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7290128", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Customers with the products below should install\u00a0 FW1060.82(1060_199), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System S1022 (9105-22A)\n * IBM Power System S1024 (9105-42A)\n * IBM Power System S1022s (9105-22B)\n * IBM Power System S1014 (9105-41B)\n * IBM Power System L1022 (9786-22H)\n * IBM Power System L1024 (9786-42H)\n * IBM Power System E1050 (9043-MRX)\n * IBM Power System S1012 (9028-21B)\n\n\n\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Customers with the products below should install\u00a0 FW1060.82(1060_199), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System S1022 (9105-22A)</li><li>IBM Power System S1024 (9105-42A)</li><li>IBM Power System S1022s (9105-22B)</li><li>IBM Power System S1014 (9105-41B)</li><li>IBM Power System L1022 (9786-22H)</li><li>IBM Power System L1024 (9786-42H)</li><li>IBM Power System E1050 (9043-MRX)</li><li>IBM Power System S1012 (9028-21B)</li></ol><p></p><p><em>The images mentioned above can be located at IBM Fix Central : </em><a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"><em>https://www.ibm.com/support/fixcentral/</em></a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-13T03:55:39.880184Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T11:57:49.892Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "IBM Power Systems Firmware Buffer Overflow", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "PowerVM Hypervisor", "versions": [{"status": "affected", "version": "FW1060.00", "versionType": "semver", "lessThanOrEqual": "FW1060.81"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install\u00a0 FW1060.82(1060_199), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System S1022 (9105-22A)\n * IBM Power System S1024 (9105-42A)\n * IBM Power System S1022s (9105-22B)\n * IBM Power System S1014 (9105-41B)\n * IBM Power System L1022 (9786-22H)\n * IBM Power System L1024 (9786-42H)\n * IBM Power System E1050 (9043-MRX)\n * IBM Power System S1012 (9028-21B)\n\n\n\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "value": "<p>Customers with the products below should install\u00a0 FW1060.82(1060_199), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System S1022 (9105-22A)</li><li>IBM Power System S1024 (9105-42A)</li><li>IBM Power System S1022s (9105-22B)</li><li>IBM Power System S1014 (9105-41B)</li><li>IBM Power System L1022 (9786-22H)</li><li>IBM Power System L1024 (9786-42H)</li><li>IBM Power System E1050 (9043-MRX)</li><li>IBM Power System S1012 (9028-21B)</li></ol><p></p><p><em>The images mentioned above can be located at IBM Fix Central : </em><a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"><em>https://www.ibm.com/support/fixcentral/</em></a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7290128", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-10-12T20:51:56.396Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-13T03:55:39.880184Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T11:52:06.879Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-96266", "state": "PUBLISHED", "dateUpdated": "2026-10-12T20:51:56.396Z", "dateReserved": "2026-09-22T20:16:36.007Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-10-12T20:51:56.396Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*"], "product": "PowerVM Hypervisor", "vendor": "IBM", "versions": [{"lessThanOrEqual": "FW1060.81", "status": "affected", "version": "FW1060.00", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system."}], "id": "CVE-2026-96266", "lastModified": "2026-10-13T16:17:14.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96266", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T03:55:39.880184Z", "version": "2.0.3"}}]}, "published": "2026-10-12T21:17:24.330", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7290128"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[FW1060.00,FW1060.81]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerVM Hypervisor", "source": "cna", "vendor": "IBM"}, "product": "powervm_hypervisor", "vendor": "ibm"}], "created": "2026-10-12T23:45:12.387545+00:00", "updated": "2026-10-13T01:30:06.541778+00:00", "vendors": ["ibm", "ibm$PRODUCT$powervm_hypervisor"]}