CVE-2026-17427: This Power System update is being released to address

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates adjacent-network access (AV:A). No privileges or user interaction are required (PR:N/UI:N).

Q: What is the expected security impact?

The issue can cause a denial of service with high availability impact (A:H). The CVSS vector indicates no confidentiality or integrity impact (C:N/I:N).

Published Oct 28, 2026

Updated

IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input length.

Other sources

OPENBMC could allow a remote attacker to cause a denial of service due to improper validation of input length.

— IBM

Affected Software

4 affected components

IBM OPENBMC<=FW1060.00 - FW1060.81

IBM OPENBMC<=OP940.00 - OP940.A2

IBM OPENBMC<=OP910.00 - OP910.95

IBM Power Hardware Management Console<=OP940.00 - OP940.82

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Power Systems Firmware FW1060 to a version that resolves this vulnerability.
Fixed in FW1060.82(1060_199)
Upgrade
Upgrade IBM Power Systems Firmware OP940 to a version that resolves this vulnerability.
Fixed in OP940.83
Upgrade
Upgrade IBM Power Systems Firmware OP940 to a version that resolves this vulnerability.
Fixed in OP940.A3
Upgrade
Upgrade IBM Power Systems Firmware OP910 to a version that resolves this vulnerability.
Fixed in OP910.96

Event History

Oct 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·07:15 PM

Data Sourced

via MITRE·07:15 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294278

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates adjacent-network access (AV:A). No privileges or user interaction are required (PR:N/UI:N).

What is the expected security impact?

The issue can cause a denial of service with high availability impact (A:H). The CVSS vector indicates no confidentiality or integrity impact (C:N/I:N).

CVE-2026-17427: This Power System update is being released to address

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?