CVE-2026-93306

Analyzed Analyzed - Analysis Complete

Denial of Service in IBM Server Firmware

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: IBM Corporation

Description

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93306

EUVD

EUVD-2026-87107

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	power_system_e1080_(9080-hex)_firmware	From fw1060.00 (inc) to fw1060.82 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	From fw1110.00 (inc) to fw1110.32 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	From fw1120.00 (inc) to fw1120.02 (exc)
ibm	power_system_s922_(9009-22g)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_h922_(9223-22s)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_s914_(9009-41g)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_s924_(9009-42g)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_h924_(9223-42s)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_e950_(9040-mr9)_firmware	From fw950.00 (inc) to fw950.h4 (exc)
ibm	power_system_e980_(9080-m9s)_firmware	From fw950.00 (inc) to fw950.h4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Server Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3. An unauthenticated attacker on the management network can send a malformed HTTPS request to the ASMI web interface, causing the web server to crash with possible memory corruption and generate an error log. The interface restarts automatically, but repeated attacks could lead to sustained loss of access.

Detection Guidance

Detect this vulnerability by monitoring for repeated crashes or restarts of the ASMI web interface on IBM servers running affected firmware versions. Check error logs for malformed HTTPS requests targeting ASMI. Use network scanning tools to identify IBM servers with exposed ASMI interfaces on the management network.

Impact Analysis

The vulnerability can lead to loss of access to the ASMI management interface, causing downtime for server management. Memory corruption may occur during crashes, potentially affecting system stability. An attacker could exploit this to disrupt operations but cannot directly access sensitive data.

Compliance Impact

This vulnerability primarily impacts availability and integrity of the ASMI interface, which could lead to non-compliance with regulations requiring timely access to systems or data. For example, HIPAA requires access controls and audit logs; repeated crashes may hinder compliance. GDPR's availability principle could also be affected.

Mitigation Strategies

Immediately update IBM Server Firmware to versions beyond the affected range (FW1120.01, FW1110.31, FW1060.81, FW950.H3). Restrict access to the ASMI web interface by isolating it on a dedicated management network with strict access controls. Monitor for unusual HTTPS traffic patterns targeting ASMI.

Hi! I’m here to help you understand CVE-2026-93306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70