CVE-2026-16938: Power System Missing Authorization
IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Server Firmwareto a version that resolves this vulnerability.Fixed in FW1060.81(1060_184)Patch 1060_184 - Upgrade
Upgrade
IBM Server Firmwareto a version that resolves this vulnerability.Fixed in FW1120.01(1120_167)Patch 1120_167 - Upgrade
Upgrade
IBM Server Firmwareto a version that resolves this vulnerability.Fixed in FW1110.31(1110_134)Patch 1110_134 - Upgrade
Upgrade
IBM Server Firmwareto a version that resolves this vulnerability.Fixed in FW950.H3(950_230)Patch 950_230 - Operational
If the managed system has been placed into a non-production operational mode via the FSP, perform explicit operator intervention to clear the affected configuration to restore normal operation; this condition persists across FSP resets.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires authenticated administrator-level access to the Flexible Service Processor (FSP). The attack vector is adjacent-network based, and no user interaction is required.
Which firmware releases are affected?
Affected releases are FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; and FW950.00 through FW950.H2.
What is the operational impact if the issue is exploited?
An attacker can place the managed system into a non-production operational mode, which can disable certain system components and cause an availability impact.
Does restarting the FSP restore normal operation?
No. The condition persists across FSP resets. An operator must explicitly clear the affected configuration to restore normal operation.