CVE-2026-17063 in Power Systems Firmware
Summary
by MITRE • 08/19/2026
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and availability impact.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the critical communication interface between the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) and the host operating system on IBM Power Systems servers running specific firmware versions including FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. This architectural component serves as the primary mechanism for out-of-band management, allowing administrators to monitor hardware health, control power states, and perform remote diagnostics independent of the host operating system's status. The flaw exploits a lack of sufficient validation or access controls within this specific interface, creating a pathway that bypasses standard security boundaries designed to isolate management functions from critical compute resources.
An attacker who has already compromised the BMC/FSP by obtaining service account credentials or root-level administrative access can leverage this vulnerability to directly interact with and manipulate the host processor state. This capability allows for unauthorized reading of sensitive data residing in memory, effectively leading to a breach of confidentiality as internal system states and potentially confidential information hosted on the machine are exposed. Furthermore, the attacker possesses the ability to disrupt normal processor operations by injecting invalid commands or altering execution contexts, which can cause immediate instability within the managed system.
The operational impact of this vulnerability is severe due to its potential for causing a denial of service against all partitions hosted on the affected hardware. Since IBM Power Systems often utilize logical partitioning (LPAR) technology to run multiple operating systems concurrently on a single physical server, compromising the host processor state can cascade into failures across these virtualized environments. This results in significant availability impact as workloads are interrupted or halted unexpectedly, leading to potential data loss and extended downtime for critical business applications relying on this infrastructure.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically regarding the failure to restrict access to sensitive system resources via management interfaces. It also maps closely to MITRE ATT&CK techniques related to System Firmware manipulation and potential privilege escalation within virtualized environments, highlighting the risk of lateral movement or total infrastructure compromise when out-of-band management planes are breached.
To mitigate this risk, organizations must ensure that all IBM Power Systems firmware is updated to versions where these interface vulnerabilities have been patched by the vendor. Access to BMC/FSP interfaces should be strictly restricted using strong authentication mechanisms and network segmentation to prevent unauthorized access from less trusted networks. Additionally, implementing least-privilege principles for service accounts associated with management controllers can reduce the attack surface available to potential adversaries seeking to exploit this specific flaw in processor state manipulation.