CVE-2026-17093
Received Received - Intake

Firmware Boot Stage Compromise in IBM Power Systems

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-17093
EUVD
EUVD-2026-62633

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware From FW1110.00 (inc) to FW1110.30 (inc)
ibm power_systems_firmware From FW1060.00 (inc) to FW1060.80 (inc)
ibm power_systems_firmware From FW950.00 (inc) to FW950.H2 (inc)
ibm power_systems_firmware From OP940.00 (inc) to OP940.a1 (inc)
ibm power_systems_firmware From OP940.00 (inc) to OP940.81 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17093 is a vulnerability in IBM Power Systems Firmware where improper parsing of host firmware configuration data allows an attacker with service-level access to the BMC or FSP to inject specially crafted configuration data. This compromises the host firmware boot stage and all subsequent components loaded during boot, leading to confidentiality, integrity, and availability impacts on the managed system.

Detection Guidance

Detection requires checking firmware versions against IBM's affected releases. Use IBM tools like 'UpdateXpress System Pack Installer' or BMC/FSP logs to verify firmware versions. Check for unusual boot sequences or errors in system logs that may indicate compromised firmware.

Impact Analysis

An attacker could exploit this vulnerability to gain control over the firmware boot process, potentially leading to unauthorized access, data breaches, system crashes, or complete system compromise. This could result in loss of sensitive data, system unavailability, or unauthorized modifications to system operations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of customer trust due to compromised data confidentiality and integrity.

Mitigation Strategies

Immediately update affected IBM Power Systems firmware to the latest patched versions provided by IBM. Access IBM Fix Central to download and install the appropriate firmware updates for your specific model. Ensure no unauthorized access to BMC/FSP and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart