CVE-2026-16938: Power System Missing Authorization
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems Firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_184)Patch FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_167)Patch FW1120.01(1120_167) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_134)Patch FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP)to a version that resolves this vulnerability.Fixed in FW950.H3(950_230)Patch FW950.H3(950_230) - Operational
If exploitation occurs and the managed system is left in a non-production operational mode where system components are disabled, perform explicit operator intervention to clear the affected configuration to restore normal operation; this condition persists across FSP resets.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires authenticated administrator-level access to the Flexible Service Processor (FSP). The attack vector is adjacent-network based, and no user interaction is required.
Which firmware releases are affected?
Affected releases are FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; and FW950.00 through FW950.H2.
What is the operational impact if the issue is exploited?
An attacker can place the managed system into a non-production operational mode, which can disable certain system components and cause an availability impact.
Does restarting the FSP restore normal operation?
No. The condition persists across FSP resets. An operator must explicitly clear the affected configuration to restore normal operation.