CVE-2026-16835: Power System Improper Certificate Validation
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems Firmwareto a version that resolves this vulnerability.Fixed in FW1060.81Patch 1060_184 - Upgrade
Upgrade
IBM Power Systems Firmwareto a version that resolves this vulnerability.Fixed in FW1120.01Patch 1120_167 - Upgrade
Upgrade
IBM Power Systems Firmwareto a version that resolves this vulnerability.Fixed in FW1110.31Patch 1110_134 - Upgrade
Upgrade
IBM Power Systems Firmwareto a version that resolves this vulnerability.Fixed in FW950.H3Patch 950_230
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running the listed IBM Server Firmware releases are exposed if an attacker can reach the FSP management network. The attacker does not need authentication or user interaction.
What level of access can an attacker gain?
An attacker can bypass authentication and perform any administrative operation on the managed system. This includes controlling partition power state and configuration and accessing consoles across all hosted partitions.
What can be done if firmware updates cannot be applied immediately?
The provided information identifies the management network as the required attack path. Restricting access to that network limits exposure, but no specific workaround is provided.
Which firmware releases are identified as affected?
The affected releases are FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; and FW950.00 through FW950.H2.