CVE-2026-96265 in Power Systems Firmware
Summary
by MITRE • 10/13/2026
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified within IBM Power Systems Firmware versions FW1060.00 through FW1060.81 represents a critical security flaw located in the service processor mailbox interface of the Flexible Service Processor, commonly referred to as FSP. The FSP serves as an out-of-band management controller that operates independently from the main host processors, providing essential functions such as remote console access, firmware updates, and hardware diagnostics. This specific architectural design creates a trust boundary between the service processor and the host system's boot stack. The flaw arises because the mailbox interface, which facilitates communication between these two distinct domains, lacks sufficient validation mechanisms for incoming messages when accessed by an attacker who has already obtained authenticated service-level access to the FSP.
An adversary possessing valid credentials with service-level privileges can exploit this weakness by transmitting a specially crafted mailbox message designed to bypass internal checks. This malicious payload allows the attacker to read from or write to arbitrary regions of Hostboot memory, which is responsible for initializing hardware and loading the hypervisor during the system startup sequence. By manipulating these critical memory structures, the attacker gains the ability to alter the boot process itself. This capability effectively compromises the integrity of the host firmware stack, allowing for the insertion of malicious code or the modification of security policies before the operating environment is fully established.
The operational impact of this vulnerability extends across all three pillars of information security: confidentiality, integrity, and availability. Due to the ability to read arbitrary memory regions, an attacker can extract sensitive data including cryptographic keys, user credentials, and proprietary system configurations, leading to a severe breach of confidentiality. The capacity to modify Hostboot memory enables the persistence of rootkits or boot-level malware that survive reboots and are difficult to detect by standard endpoint security tools, resulting in significant integrity violations. Furthermore, an attacker could corrupt critical boot structures to prevent the system from starting correctly or cause it to operate with degraded functionality, thereby achieving a denial-of-service condition against the managed system.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if authentication bypass is involved in related attack vectors, though primarily it reflects weaknesses in input validation within privileged interfaces (CWE-20). In terms of the MITRE ATT&CK framework, exploitation maps to T1531 Account Access Removal or potentially T1608 Install Defective Firmware if persistent backdoors are installed via memory modification. It also relates to T1499 Endpoint Denial of Service through system instability caused by corrupted boot structures.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is the application of the firmware update provided by IBM that addresses this specific mailbox interface validation flaw, ensuring systems are updated beyond FW1060.81 or to a patched version within that range if available. Organizations should enforce strict access controls for service-level accounts on FSPs, utilizing multi-factor authentication and limiting these credentials to authorized administrative personnel only. Network segmentation is also critical; the management network containing FSP interfaces must be isolated from general corporate networks to prevent lateral movement by attackers who may have compromised other systems but lack direct physical or authenticated access to the hardware management controllers. Regular auditing of service processor logs for unusual mailbox activity can aid in early detection of exploitation attempts.