CVE-2026-17414: Power System Improper Input Validation
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1060.81(1060_184) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1060.81(1060_191) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1110.31(1110_134) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1110.31(1110_155) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1120.01(1120_190) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1120.01(1120_167) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW950.H3(950_230)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Only affected Power Systems Firmware versions on partitions that are actively performing a network boot are exposed. Other partitions and the managed system are not affected.
What does an attacker need to exploit it?
The attacker does not need authentication, but must have access to the same network as the partition while it is performing a network boot.
Does the default configuration allow boot image substitution?
Yes. OS secure boot is not enabled by default, and on partitions without OS secure boot an attacker can substitute the boot image and compromise everything subsequently loaded by that partition.
What is the impact if OS secure boot is enabled?
An attacker on the same network can still prevent an actively network-booting partition from completing its boot sequence. The boot-image substitution impact is specified for partitions where OS secure boot is not enabled.