Strix
62.1K

CVE-2026-16835

CRITICALCVSS 9.6/10EPSS 0.23%

Last modified

CVE-2026-16835 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.

Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.

Metrics

CVSS 3.1
9.6/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
0.23%

13.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IbmPower System E1080 \(9080-Hex\) Firmware>= fw1060.00, < fw1060.81
IbmPower System E1180 \(9080-Heu\) Firmware>= fw1110.00, < fw1110.31
IbmPower System E1180 \(9080-Heu\) Firmwarefw1120.00
IbmPower System S922 \(9009-22g\) Firmware>= fw950.00, < fw950.h3
IbmPower System H922 \(9223-22s\) Firmware>= fw950.00, < fw950.h3
IbmPower System S914 \(9009-41g\) Firmware>= fw950.00, < fw950.h3
IbmPower System S924 \(9009-42g\) Firmware>= fw950.00, < fw950.h3
IbmPower System H924 \(9223-42s\) Firmware>= fw950.00, < fw950.h3
IbmPower System E950 \(9040-Mr9\) Firmware>= fw950.00, < fw950.h3
IbmPower System E980 \(9080-M9s\) Firmware>= fw950.00, < fw950.h3

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-16835?
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
How severe is CVE-2026-16835?
CVE-2026-16835 has a CVSS score of 9.6/10 (CRITICAL severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.
How do I fix CVE-2026-16835?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-16835?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST