CVE-2026-96261

Received Received - Intake

IBM Power Systems Firmware Memory Corruption Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-96261

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	PowerVM	Hypervisor FW1060.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Power Systems Firmware versions FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the service processor can exploit it by writing specially crafted configuration data. This causes the host firmware boot stack to crash during system initialization, leading to memory corruption and potential integrity and availability issues for the managed system.

Detection Guidance

Detection requires checking IBM Power Systems Firmware versions. Verify if FW1060.00 through FW1060.81 is installed on affected systems. Use IBM tools like ASMI or HMC to inspect firmware versions. No direct commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability could cause system crashes during boot, leading to unavailability of the managed system. Memory corruption may also occur, potentially affecting system integrity. The impact is limited to systems running affected firmware versions with authenticated service-level access.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to its integrity and availability impact on the managed system. Memory corruption during system initialization may lead to unauthorized data access or system unavailability, which are critical concerns under these regulations.

Mitigation Strategies

Update IBM Power Systems Firmware to version FW1060.82 or later to address the vulnerability in host firmware configuration parsing.

Hi! I’m here to help you understand CVE-2026-96261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70