CVE-2026-17429 in Power Systems Firmware
Summary
by MITRE • 08/19/2026
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified within IBM Power Systems firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 for Power9 processors, and OP940.00 through OP940.81 for the Power HMC represents a critical failure in the security boundary between the Baseboard Management Controller or Flexible Service Processor and the host system. This architectural flaw resides specifically within the communication interface that facilitates control signals and data exchange between these management processors and the underlying hardware infrastructure. The severity of this issue is compounded by its potential to bypass traditional operating system-level protections, as it operates at a level below the hypervisor and guest partitions, effectively granting an adversary direct access to low-level hardware registers that dictate system behavior.
From a technical perspective, the core flaw involves insufficient validation or isolation mechanisms when handling write operations from the BMC or FSP to specific hardware control registers on the host processor. In a properly secured environment, such interfaces should enforce strict role-based access controls and input sanitization to prevent unauthorized modification of critical system state variables. However, in this affected firmware configuration, an attacker who has already obtained service account privileges or root-level access within the BMC or FSP operating environment can exploit this lack of restriction. By writing arbitrary data directly into these hardware control registers, the adversary gains the ability to manipulate fundamental aspects of the host's operation without triggering standard security alerts or requiring elevated permissions on the main OS kernel itself.
The operational impact of this vulnerability is severe and comprehensive, affecting all three pillars of information security: confidentiality, integrity, and availability. Because the attacker can write arbitrary data to hardware control registers, they effectively achieve full control over the host system. This level of access allows for the complete compromise of any partitions hosted on that physical server. An adversary could exfiltrate sensitive data from memory or storage (confidentiality), modify critical system files or configurations without detection by standard auditing tools (integrity), and execute commands to crash the system, halt services, or render hardware unresponsive (availability). This effectively neutralizes the security benefits of virtualization isolation, as a compromise at the management layer cascades directly into total control over all logical partitions running on that hardware.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-732 Operator Permission Assignment Errors, reflecting a fundamental failure to restrict administrative privileges appropriately within embedded systems interfaces. Furthermore, in terms of offensive security tactics, this exploit scenario maps closely to MITRE ATT&CK techniques related to System Firmware exploitation and Hardware Abstraction Layer manipulation. Attackers leveraging such vulnerabilities often aim for persistence at the firmware level, making remediation difficult as standard OS-level antivirus or endpoint detection solutions may not detect modifications occurring below the operating system boundary.
Mitigation strategies must prioritize immediate patching of all affected IBM Power Systems firmware versions to the latest secure releases provided by IBM. Organizations should also implement strict network segmentation policies for BMC and FSP management interfaces, ensuring that these components are isolated from general corporate networks and accessible only through highly secured, authenticated channels with multi-factor authentication enabled where possible. Additionally, administrators should enforce principle of least privilege on all service accounts associated with the BMC/FSP environments, regularly auditing access logs for any unusual write operations to hardware registers or unexpected elevation of privileges within the management plane. Continuous monitoring using specialized firmware integrity verification tools can also help detect unauthorized modifications before they lead to full system compromise.