CVE-2026-96263

Received Received - Intake

IBM Power Systems Firmware Code Execution Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-96263

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	PowerVM	Hypervisor FW1120.00
IBM	PowerVM	Hypervisor FW1110.00
IBM	PowerVM	Hypervisor FW1060.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM Power Systems Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81. It involves a flaw in the host firmware boot process image validation path. An attacker with service access to the service processor can provide a malicious code update image, which could allow arbitrary code execution on the host system.

Detection Guidance

Detection requires checking firmware versions against affected ranges. Use IBM tools like 'lsmcode -r' or 'hmccli' to verify Power Systems firmware versions FW1120.00-FW1120.01, FW1110.00-FW1110.31, or FW1060.00-FW1060.81. Inspect service processor logs for unauthorized code update attempts or anomalies during boot processes.

Impact Analysis

If exploited, this vulnerability could lead to a confidentiality, integrity, and availability impact on the affected host system. An attacker could gain control over the system, potentially accessing sensitive data, altering system operations, or causing system failures.

Compliance Impact

This vulnerability could lead to unauthorized code execution on IBM Power Systems, potentially compromising confidentiality, integrity, and availability of sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) due to unauthorized access or data breaches.

Mitigation Strategies

Immediately update firmware to versions outside the vulnerable ranges. Restrict physical and network access to the service processor. Disable unnecessary services on the service processor. Monitor for suspicious activity during boot processes. Apply IBM's official patches as soon as they are available.

Hi! I’m here to help you understand CVE-2026-96263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70