Arbitrary Code Execution in IBM Power Systems Firmware
CVE-2026-16687

9.6CRITICAL

Key Information:

Vendor

IBM
Status
Power Systems Firmware
Vendor
CVE Published:
19 August 2026

What is CVE-2026-16687?

IBM Power Systems Firmware contains a vulnerability within the ASMI web interface that permits unauthenticated attackers with network access to send specially crafted requests. This flaw could lead to arbitrary code execution, granting attackers complete control over the managed system. As a result, it poses significant risks to the confidentiality, integrity, and availability of the affected systems.

Affected Version(s)

Power Systems Firmware FW1120.00

Power Systems Firmware FW1110.00

Power Systems Firmware FW1060.00

References

https://www.ibm.com/support/pages/node/7283893
vendor-advisorypatch

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.