Read the docs
TI-2026-13912 Aliases CVE-2026-16687GHSA-p7wp-9r3f-5rpv

Power System Buffer Overflow

Priority MEDIUM 43CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00347 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPower Systems FirmwareFW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2—No fix listedCNA
  • Power Systems Firmware VendorIBM Affected FW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2 Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16687
  2. 2026-10-03 Alias added: GHSA-p7wp-9r3f-5rpv

References

Patch 1

  • TI-2024-30661 IBM Flexible Service Processor hard coded credentials CVSS 3.1CRITICAL 9.8
  • TI-2026-14011 Power System Improper Certificate Validation CVSS 3.1CRITICAL 9.6
  • TI-2026-15412 Power System Out-of-bounds Write CVSS 3.1HIGH 8.8
  • TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
  • TI-2026-14008 Power System Buffer Overflow CVSS 3.1HIGH 8.4
  • TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences