Authentication Bypass in IBM Power Systems Firmware

CVE-2026-16835

What is CVE-2026-16835?

IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 exhibit a critical vulnerability in the FSP management network protocol. This flaw allows unauthenticated attackers on the management network to bypass authentication mechanisms, granting them the ability to execute any administrative operation on the managed system. Potential actions include altering partition power states, adjusting configuration settings, and accessing console controls across all hosted partitions. Such unauthorized access may severely impact the confidentiality, integrity, and availability of the managed system.

References