CVE-2026-16938

Analyzed Analyzed - Analysis Complete

IBM Power Systems Firmware Privileged Access Bypass

Publication date: 2026-08-19

Last updated on: 2026-08-25

Assigner: IBM Corporation

Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-25

Generated

2026-09-09

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-16938

EUVD

EUVD-2026-62689

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	power_system_e1080_(9080-hex)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	fw1120.00
ibm	power_system_s922_(9009-22g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_h922_(9223-22s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_s914_(9009-41g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_s924_(9009-42g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_h924_(9223-42s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_e950_(9040-mr9)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_e980_(9080-m9s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Power Systems Firmware by allowing an authenticated administrator-level attacker with access to the Flexible Service Processor (FSP) to place the managed system into a non-production operational mode. This disables certain system components and persists even after FSP resets, requiring manual intervention to restore normal operation.

Detection Guidance

Detecting this vulnerability requires checking the firmware version of IBM Power Systems. Use the FSP command-line interface or IBM tools like 'lsmcode' or 'lsfware' to verify if your firmware matches affected versions (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2).

Review system logs for unauthorized changes to operational modes or disabled components. Check for persistent non-production states after FSP resets.

Impact Analysis

Exploitation results in an availability impact to the managed system, meaning critical components may be disabled, leading to reduced performance or downtime. The system remains in this state until an operator manually clears the affected configuration.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized changes to system configurations that disable critical components, potentially leading to data processing disruptions or unauthorized access. Such operational disruptions may violate availability requirements under GDPR and HIPAA, which mandate continuous access to personal health or other sensitive data.

Mitigation Strategies

Immediately restrict access to the FSP administrative interface to prevent unauthorized changes. Install the latest firmware updates: FW1120.01 or newer for Power11, FW1060.81 or newer for Power10, and FW950.H3 or newer for Power9 systems.

Manually clear any non-production operational mode configurations that may have been set. Monitor systems for persistent availability impacts and restore normal operation.

Hi! I’m here to help you understand CVE-2026-16938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70