TI-2026-14352 Aliases CVE-2026-17494 GHSA-399g-qpj2-9x43

Power System Buffer Overflow

LOW 37CWE-121Published 2026-08-19 · Updated 2026-08-22

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00169 6th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Power Systems Firmware	FW1120.00; FW1110.00 – FW1110.30	—	No fix listed	CNA

Power Systems Firmware VendorIBM Affected FW1120.00; FW1110.00 – FW1110.30 Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM

cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM

Show 18 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware::::::::	fw1110.00 to before fw1110.31	Vulnerable	IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:::::::*	fw1120.00	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:::::::*	not specified by NVD	Running on	IBM

cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-17494
2026-10-03 Alias added: GHSA-399g-qpj2-9x43

References

Patch 1

https://www.ibm.com/support/pages/node/7283220

TI-2026-15412 Power System Out-of-bounds Write CVSS 3.1HIGH 8.8
TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
TI-2026-06926 This Power System update is being released to address incorrect authorization CVSS 3.1HIGH 8.8
TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
TI-2026-14226 Power System Out-of-bounds Write CVSS 3.1HIGH 8.2
TI-2026-14221 Power System Buffer Overflow CVSS 3.1HIGH 8.2

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences