CVE-2026-16661 in PowerVM Hypervisor
Summary
by MITRE • 08/19/2026
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 are affected by a critical vulnerability located within the service processor mailbox interface. This architectural component serves as the primary communication channel between the Flexible Service Processor (FSP) and the host firmware runtime environment. The FSP is responsible for managing hardware-level operations, including power control, system monitoring, and remote management functions that operate independently of the main operating system. By targeting the mailbox interface, an attacker can bypass higher-level security controls to interact directly with low-level firmware processes. This specific flaw represents a significant breach in the isolation boundaries typically maintained between out-of-band management components and the core hypervisor execution environment, allowing for unauthorized escalation of privileges from service-level access to full host control.
The technical nature of this vulnerability involves insufficient validation or sanitization of messages passed through the mailbox interface when accessed by an authenticated user with service-level permissions on the FSP. In typical secure designs, inputs received via management interfaces should undergo rigorous integrity checks and privilege verification before being processed by critical system components. However, in these affected firmware versions, the mechanism fails to adequately restrict or validate certain commands originating from the service processor context. This deficiency allows an attacker who has obtained authenticated access at the service level to inject malicious payloads into the communication stream destined for the host firmware runtime. Because the mailbox interface operates with high privileges within the hardware abstraction layer, any code executed through this vector inherits those elevated permissions, effectively granting the attacker direct execution capabilities within the hypervisor environment without requiring further exploitation steps or privilege escalation techniques against user-space applications.
The operational impact of exploiting this vulnerability is severe and comprehensive, resulting in a total compromise of confidentiality, integrity, and availability for the managed system. Once arbitrary code is executed in the host firmware runtime, the attacker gains full control over the underlying hardware resources mediated by PowerVM. This level of access enables the exfiltration of sensitive data stored on or processed by the virtual machines hosted within the partition, compromising confidentiality. It also allows for the modification of critical system configurations and hypervisor settings, undermining integrity. Furthermore, an attacker can disrupt service availability by halting partitions, corrupting firmware states, or rendering the managed system unresponsive to legitimate management requests. This scenario effectively neutralizes all security controls implemented at the guest operating system level, as the compromise occurs below that layer in the hardware abstraction and virtualization stack.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Injection) or more broadly CWE-20 Poor Input Validation within the context of firmware interfaces. The exploitation path corresponds to MITRE ATT&CK technique T1546.009 Event Triggered Execution: Firmware, specifically leveraging management controller interactions such as BMCs and FSPs for persistence or privilege escalation. Additionally, it relates to CWE-287 Improper Authentication in the context of service-level access being leveraged for higher-tier execution. The attack vector is classified as adjacent network or local physical depending on how the FSP interface is exposed, but critically requires initial authenticated access at the service level rather than unauthenticated remote code execution.
Mitigation strategies must focus primarily on applying the vendor-provided firmware updates that address this specific flaw in the mailbox interface validation logic. Organizations should prioritize patching all affected PowerVM versions to ensure that input sanitization and privilege checks are correctly enforced for messages originating from the FSP. In environments where immediate patching is not feasible, strict access control policies must be implemented on the service processor interfaces. This includes restricting network-based management protocols such as IPMI or Redfish to trusted administrative subnets only, enforcing multi-factor authentication for all service-level accounts, and auditing logs for any unusual command sequences directed at the mailbox interface. Additionally, segmenting the out-of-band management network from production data networks reduces the attack surface available to adversaries who may have compromised other systems within the infrastructure. Regular security assessments of firmware configurations should also be conducted to ensure that default credentials are changed and unnecessary services on the FSP are disabled.