Read the docs
TI-2026-15412 Aliases CVE-2026-18821GHSA-3c3p-64wc-c8w7

Power System Out-of-bounds Write

Priority MEDIUM 40CWE-787Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPowerVM HypervisorFW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2—No fix listedCNA
  • PowerVM Hypervisor VendorIBM Affected FW1120.00; FW1110.00 – FW1110.30; FW1060.00 – FW1060.80; FW950.00 – FW950.H2 Fixed in — No fix listed CNA

CPE configurations NVD · 60

CPEVersionsRoleVendor
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
  • cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
Show 50 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware:*:*:*:*:*:*:*:*fw1060.00 to before fw1060.81VulnerableIBM
cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*fw1110.00 to before fw1110.31VulnerableIBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:*fw1120.00VulnerableIBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*fw950.00 to before fw950.h3VulnerableIBM
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.81 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.31 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:fw1120.00:*:*:*:*:*:*:* Versions fw1120.00 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h3 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18821
  2. 2026-10-03 Alias added: GHSA-3c3p-64wc-c8w7
  3. 2026-10-25 Priority changed: LOW → MEDIUM

References

  • TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
  • TI-2026-06926 This Power System update is being released to address incorrect authorization CVSS 3.1HIGH 8.8
  • TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
  • TI-2026-14226 Power System Out-of-bounds Write CVSS 3.1HIGH 8.2
  • TI-2026-14221 Power System Buffer Overflow CVSS 3.1HIGH 8.2
  • TI-2026-14095 Power System Integer Overflow CVSS 3.1HIGH 8.2
See all 31 →

Sources