CVE-2026-17429
Received Received - Intake

IBM Power Systems Firmware Privilege Escalation Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-17429
EUVD
EUVD-2026-62685

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware 1120.00
ibm power_systems_firmware From 1110.00 (inc) to 1110.30 (inc)
ibm power_systems_firmware From 1060.00 (inc) to 1060.80 (inc)
ibm power_systems_firmware From 950.00 (inc) to 950.H2 (inc)
ibm power_systems_firmware From 940.00 (inc) to 940.a1 (inc)
ibm power_systems_firmware From 940.00 (inc) to 940.81 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17429 is a vulnerability in IBM Power Systems Firmware where an attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers. This allows full control over the host system and all hosted partitions, leading to confidentiality, integrity, and availability impacts.

Detection Guidance

Detection requires checking the firmware versions of IBM Power Systems. Compare installed versions against affected releases: FW1120.00, FW1110.00–FW1110.30, FW1060.00–FW1060.80, FW950.00–FW950.H2, OP940.00–OP940.a1/81. Use IBM tools or BMC/FSP interfaces to query firmware versions.

Impact Analysis

An attacker exploiting this vulnerability could gain complete control over the host system and all hosted partitions. This could result in unauthorized access to sensitive data, modification or deletion of critical system files, and disruption of system operations, causing significant operational and security risks.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Install the latest IBM firmware updates immediately. Apply FW1110.31(1110_134), FW1120.01(1120_167), or newer versions specific to your system model. No workarounds exist; updates are mandatory to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart