CVE-2026-16682: This Power System update is being released to address

Q: What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with no privileges or user interaction required. The supplied vector identifies adjacent-network access as the attack vector.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can cause a denial of service. The provided impact information does not indicate confidentiality or integrity impact.

Q: Which firmware levels are affected?

Affected ranges are FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82.

Published Oct 28, 2026

Updated

IBM Power Systems Firmware could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.

Other sources

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.

— MITRE

Affected Software

6 affected components

IBM OPENBMC<=FW1120.00 - FW1120.01

IBM OPENBMC<=FW1110.00 - FW1110.31

IBM OPENBMC<=FW1060.00 - FW1060.81

IBM OPENBMC<=OP940.00 - OP940.A2

IBM OPENBMC<=OP910.00 - OP910.95

IBM Hardware Management Console<=OP940.00 - OP940.82

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch FW1060.82(1060_199)
Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch FW1120.02(1120_195)
Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch FW1110.32(1110_160)
Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch OP940.83
Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch OP940.A3
Upgrade
Upgrade IBM Power Systems Firmware to a version that resolves this vulnerability.
Patch OP910.96

Event History

Oct 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294279

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with no privileges or user interaction required. The supplied vector identifies adjacent-network access as the attack vector.

What is the expected impact if exploitation succeeds?

Successful exploitation can cause a denial of service. The provided impact information does not indicate confidentiality or integrity impact.

Which firmware levels are affected?

Affected ranges are FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82.

CVE-2026-16682: This Power System update is being released to address

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which firmware levels are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which firmware levels are affected?