CVE-2026-16930: Power System Missing Authorization
IBM Power Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
Other sources
Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_184)Patch FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_134)Patch FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_167)Patch FW1120.01(1120_167) - Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_155)Patch FW1110.31(1110_155) - Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_190)Patch FW1120.01(1120_190) - Upgrade
Upgrade
IBM Power Firmware (BMC/FSP-host interface)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_191)Patch FW1060.81(1060_191)
Event History
Frequently Asked Questions
Which firmware releases are affected?
Affected releases are FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.
What access would an attacker need before exploiting this issue?
The attacker needs service account or root access to the BMC/FSP. The provided information does not describe exploitation by an unauthenticated or lower-privileged attacker.
What systems are at risk if the vulnerability is exploited?
Successful exploitation permits arbitrary code execution on the host system and gives full control over that host and all hosted partitions. The stated impact includes confidentiality, integrity, and availability.