CVE-2026-16687: Power System Buffer Overflow
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
Other sources
Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1060.81Patch 1060_184 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1120.01Patch 1120_167 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1110.31Patch 1110_134 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW950.H3Patch 950_230
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, or FW950.00 through FW950.H2 are affected when their ASMI web interface is reachable by an attacker with network access.
Does an attacker need credentials or user interaction to exploit this vulnerability?
No. Exploitation is unauthenticated and requires no user interaction; an attacker only needs network access to send a malformed request to the FSP through the ASMI web interface.
What is the potential impact of successful exploitation?
An attacker can achieve arbitrary code execution on the FSP and gain full control over the managed system. This can affect confidentiality, integrity, and availability.