TI-2026-15435 Aliases CVE-2026-18857 GHSA-34jw-2gcw-f6v2

This Power System update is being released to address

LOW 15CWE-125Published 2026-09-24 · Updated 2026-09-24

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00107 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	OPENBMC	FW1120.00 – FW1120.01; FW1110.00 – FW1110.31; FW1060.00 – FW1060.81	—	No fix listed	CNA

OPENBMC VendorIBM Affected FW1120.00 – FW1120.01; FW1110.00 – FW1110.31; FW1060.00 – FW1060.81 Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:::::::*	not specified by NVD	Running on	IBM

cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Show 24 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware::::::::	fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware::::::::	fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware::::::::	fw1120.00 to before fw1120.02	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware::::::::	fw1060.00 to before fw1060.82	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:::::::*	not specified by NVD	Running on	IBM

cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.32; fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21b\)_firmware:*:*:*:*:*:*:*:* Versions fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1112_\(9242-21t\)_firmware:*:*:*:*:*:*:*:* Versions fw1120.00 to before fw1120.02 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1112_\(9242-21t\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.82 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-18857
2026-10-03 Alias added: GHSA-34jw-2gcw-f6v2

References

Patch 1

https://www.ibm.com/support/pages/node/7289253

TI-2026-15412 Power System Out-of-bounds Write CVSS 3.1HIGH 8.8
TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
TI-2026-06926 This Power System update is being released to address incorrect authorization CVSS 3.1HIGH 8.8
TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
TI-2026-14226 Power System Out-of-bounds Write CVSS 3.1HIGH 8.2
TI-2026-14221 Power System Buffer Overflow CVSS 3.1HIGH 8.2

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences