CVE-2026-18849: IBM OpenBMC Code Execution

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-09-02
Weakness: CWE-22

Description

IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

Affected products

IBM OPENBMC: from fw1060.00 through fw1060.80
IBM Power System E1050 (9043-Mrx) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System L1022 (9786-22H) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System L1024 (9786-42H) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System S1012 (9028-21B) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System S1014 (9105-41B) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System S1022 (9105-22A) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System S1022S (9105-22B) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81
IBM Power System S1024 (9105-42A) Firmware: from fw1060.00 before fw1060.81 — fixed in fw1060.81

How to fix

Upgrade to a fixed version: IBM Power System E1050 (9043-Mrx) Firmware fw1060.81; IBM Power System L1022 (9786-22H) Firmware fw1060.81; IBM Power System L1024 (9786-42H) Firmware fw1060.81; IBM Power System S1012 (9028-21B) Firmware fw1060.81; IBM Power System S1014 (9105-41B) Firmware fw1060.81; IBM Power System S1022 (9105-22A) Firmware fw1060.81; IBM Power System S1022S (9105-22B) Firmware fw1060.81; IBM Power System S1024 (9105-42A) Firmware fw1060.81. Check the vendor advisory for mitigations.

References

https://www.ibm.com/support/pages/node/7283590

Get alerted when CVE-2026-18849 or the next vulnerability affects your stack