CVE-2026-96262

Received Received - Intake

IBM Power Systems Firmware Code Execution via FSP Mailbox

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-96262

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	PowerVM	Hypervisor FW1060.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Power Systems Firmware versions FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage. This allows arbitrary code execution in the host firmware runtime, giving the attacker full access to the managed system's memory and hardware interfaces.

Detection Guidance

Detection requires authenticated access to the FSP (Flexible Service Processor) on IBM Power Systems. Check for unusual mailbox messages or unexpected changes in firmware runtime attributes. Monitor for arbitrary code execution in host firmware runtime. No specific commands are provided in the context.

Impact Analysis

This vulnerability can lead to a confidentiality, integrity, and availability impact on the managed system. An attacker could gain full control over the system's memory and hardware interfaces, potentially causing data breaches, system disruptions, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability allows an attacker with authenticated service-level access to execute arbitrary code in the host firmware runtime, potentially compromising the confidentiality, integrity, and availability of the managed system. Such a breach could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security).

Mitigation Strategies

Update IBM Power Systems Firmware to a version beyond FW1060.81 to address the vulnerability in the service processor mailbox interface.

Hi! I’m here to help you understand CVE-2026-96262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70