CVE-2026-18848
Received Received - Intake

Unauthenticated Administrative Actions via ASMI Web Interface in IBM Power Systems Firmware

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18848
EUVD
EUVD-2026-62688

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware fw1120.00
ibm power_systems_firmware From fw1110.00 (inc) to fw1110.30 (inc)
ibm power_systems_firmware From fw1060.00 (inc) to fw1060.80 (inc)
ibm power_systems_firmware From fw950.00 (inc) to fw950.h2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18848 is a Cross-Site Request Forgery (CSRF) vulnerability in the ASMI web interface of IBM Power Systems Firmware. An attacker can exploit it by tricking a logged-in ASMI administrator into visiting a malicious webpage. This allows the attacker to silently perform administrative actions on the FSP (Flexible Service Processor) as if they were the administrator.

Detection Guidance

Detection involves checking the firmware version of IBM Power Systems. Compare installed versions against affected releases: FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2. Use ASMI or HMC interfaces to verify firmware levels.

Impact Analysis

This vulnerability can lead to confidentiality, integrity, and availability impacts on the managed system. An attacker could gain unauthorized control over the FSP, potentially accessing sensitive data, altering system configurations, or disrupting operations.

Mitigation Strategies

Update firmware immediately to the latest patched versions: FW1120.01(1120_167) or newer for Power 11, FW1060.81(1060_184) for Power 10, and FW950.H3(950_230) for Power 9 systems. No workarounds exist; apply fixes promptly to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart