Read the docs
TI-2026-14008 Aliases CVE-2026-16832GHSA-m373-q23q-fx37

Power System Buffer Overflow

Priority LOW 38CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPower Systems FirmwareFW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2—No fix listedCNA
  • Power Systems Firmware VendorIBM Affected FW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2 Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
  • cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16832
  2. 2026-10-03 Alias added: GHSA-m373-q23q-fx37

References

Patch 1

  • TI-2024-30661 IBM Flexible Service Processor hard coded credentials CVSS 3.1CRITICAL 9.8
  • TI-2026-14011 Power System Improper Certificate Validation CVSS 3.1CRITICAL 9.6
  • TI-2026-13912 Power System Buffer Overflow CVSS 3.1CRITICAL 9.6
  • TI-2026-15412 Power System Out-of-bounds Write CVSS 3.1HIGH 8.8
  • TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
  • TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences