CVE-2026-16835
Received Received - Intake

Authentication Bypass in IBM Power Systems Firmware

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-16835
EUVD
EUVD-2026-62691

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware 1120.00
ibm power_systems_firmware From 1110.00 (inc) to 1110.30 (inc)
ibm power_systems_firmware From 1060.00 (inc) to 1060.80 (inc)
ibm power_systems_firmware From 950.00 (inc) to 950.H2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An unauthenticated attacker on the management network can bypass authentication and perform administrative operations on the managed system, including controlling partition power state, configuration, and console access across all hosted partitions.

Detection Guidance

Detecting this vulnerability requires checking the firmware versions of IBM Power Systems. Use the FSP (Flexible Service Processor) interface or IBM tools to verify if your system is running affected firmware versions (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, or FW950.00-FW950.H2). Monitor network traffic on the FSP management network for unauthorized administrative operations.

Impact Analysis

This vulnerability can lead to significant confidentiality, integrity, and availability impacts on the managed system. Attackers can gain full control over partition power state, configuration, and console access, potentially disrupting operations or stealing sensitive data.

Mitigation Strategies

Immediately install the latest firmware updates: FW1120.01 or newer for Power11, FW1060.81 or newer for Power10, and FW950.H3 or newer for Power9. Until patches are applied, restrict access to the FSP's network interface and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart