CVE-2026-16832: Power System Buffer Overflow

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-08-25
Weakness: CWE-121

Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

Affected products

IBM Power System E1080 (9080-Hex) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System E1180 (9080-Heu) Firmware: from fw1110.00 before fw1110.31; fw1120.00 — fixed in fw1110.31
IBM Power System E950 (9040-Mr9) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System E980 (9080-M9S) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System H922 (9223-22S) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System H924 (9223-42S) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System S914 (9009-41G) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System S922 (9009-22G) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3
IBM Power System S924 (9009-42G) Firmware: from fw950.00 before fw950.h3 — fixed in fw950.h3

How to fix

Upgrade to a fixed version: IBM Power System E1080 (9080-Hex) Firmware fw1060.81; IBM Power System E1180 (9080-Heu) Firmware fw1110.31; IBM Power System E950 (9040-Mr9) Firmware fw950.h3; IBM Power System E980 (9080-M9S) Firmware fw950.h3; IBM Power System H922 (9223-22S) Firmware fw950.h3; IBM Power System H924 (9223-42S) Firmware fw950.h3; IBM Power System S914 (9009-41G) Firmware fw950.h3; IBM Power System S922 (9009-22G) Firmware fw950.h3; IBM Power System S924 (9009-42G) Firmware fw950.h3. Check the vendor advisory for mitigations.

References

https://www.ibm.com/support/pages/node/7283895

Get alerted when CVE-2026-16832 or the next vulnerability affects your stack