CVE-2026-16687 in Power Systems
Summary
by MITRE • 08/19/2026
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The IBM Power Systems firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 are affected by a critical security vulnerability within the Advanced System Management Interface web interface. This flaw allows an unauthenticated attacker who has network access to interact with the Firmware Service Processor in a manner that bypasses standard authentication mechanisms. The core of this issue lies in the handling of specific requests sent to the FSP, where malformed input is processed without adequate validation or sanitization checks.
This technical deficiency enables arbitrary code execution on the managed system. By exploiting this flaw, an attacker can inject and execute malicious commands directly within the firmware environment. Because the ASMI interface provides deep administrative control over hardware resources, successful exploitation grants the attacker full operational control of the underlying infrastructure. This level of access effectively compromises the entire security posture of the affected IBM Power Systems server.
The impact of this vulnerability is severe across all three pillars of information security: confidentiality, integrity, and availability. With arbitrary code execution capabilities, an adversary can exfiltrate sensitive data stored on or processed by the system, violating confidentiality requirements. The ability to modify firmware settings or installed software undermines system integrity, allowing for persistent backdoors or configuration changes that evade standard detection methods. Furthermore, the attacker could disrupt services or render the hardware inoperable through destructive commands, leading to significant availability losses and operational downtime for critical business functions.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the arbitrary code execution aspect resulting from malformed requests. Additionally, because it involves unauthenticated access via a network service, it relates to CWE-287 Improvement in Authentication and CWE-352 Cross-Site Request Forgery if applicable depending on specific implementation details, though primarily it represents a critical authentication bypass leading to remote code execution. In the context of the MITRE ATT&CK framework, this exploit maps to techniques involving Initial Access via valid accounts or unauthenticated access, followed by Execution through command and script invocation within the firmware layer.
Mitigation strategies must prioritize immediate patching of the affected IBM Power Systems firmware versions to addresses that include fixes for this ASMI web interface flaw. Organizations should also implement network segmentation to restrict direct internet-facing access to management interfaces like ASMI, ensuring they are only accessible from trusted internal networks or through secure jump hosts with multi-factor authentication enabled where possible. Continuous monitoring of FSP logs and network traffic patterns can help detect anomalous requests indicative of exploitation attempts before full system compromise occurs.