CVE-2026-16938
Received Received - Intake

IBM Power Systems Firmware Privileged Access Bypass

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-16938
EUVD
EUVD-2026-62689

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware 1120.00
ibm power_systems_firmware From 1110.00 (inc) to 1110.30 (inc)
ibm power_systems_firmware From 1060.00 (inc) to 1060.80 (inc)
ibm power_systems_firmware From 950.00 (inc) to 950.H2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects IBM Power Systems Firmware by allowing an authenticated administrator-level attacker with access to the Flexible Service Processor (FSP) to place the managed system into a non-production operational mode. This disables certain system components and persists even after FSP resets, requiring manual intervention to restore normal operation.

Detection Guidance

Detecting this vulnerability requires checking the firmware version of IBM Power Systems. Use the FSP command-line interface or IBM tools like 'lsmcode' or 'lsfware' to verify if your firmware matches affected versions (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2).

Review system logs for unauthorized changes to operational modes or disabled components. Check for persistent non-production states after FSP resets.

Impact Analysis

Exploitation results in an availability impact to the managed system, meaning critical components may be disabled, leading to reduced performance or downtime. The system remains in this state until an operator manually clears the affected configuration.

Mitigation Strategies

Immediately restrict access to the FSP administrative interface to prevent unauthorized changes. Install the latest firmware updates: FW1120.01 or newer for Power11, FW1060.81 or newer for Power10, and FW950.H3 or newer for Power9 systems.

Manually clear any non-production operational mode configurations that may have been set. Monitor systems for persistent availability impacts and restore normal operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart