Vulnerability in IBM PowerVM Hypervisor Service Processor Mailbox Interface
CVE-2026-16707

8.2HIGH

Key Information:

Vendor

IBM
Status
Powervm Hypervisor
Vendor
CVE Published:
19 August 2026

What is CVE-2026-16707?

IBM PowerVM Hypervisor firmware versions are vulnerable due to an issue in the service processor mailbox interface. An attacker with authenticated service-level access can craft specific messages that allow them to read or alter sensitive regions of Hostboot memory. This can undermine the host firmware boot stack and the hypervisor dependent on it. Consequently, it poses significant risks to confidentiality, integrity, and availability, affecting the overall security posture of the managed systems.

Affected Version(s)

PowerVM Hypervisor FW1120.00

PowerVM Hypervisor FW1110.00

PowerVM Hypervisor FW1060.00

References

https://www.ibm.com/support/pages/node/7283235
vendor-advisorypatch

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.