Arbitrary Code Execution in IBM OpenBMC Firmware by IBM
CVE-2026-18849

6.8MEDIUM

Key Information:

Vendor

IBM
Status
Openbmc
Vendor
CVE Published:
19 August 2026

What is CVE-2026-18849?

IBM OpenBMC firmware versions FW1060.00 through FW1060.80 are exposed to a vulnerability during the firmware update process. An attacker with authenticated administrator-level access to the Baseboard Management Controller (BMC) can exploit this weakness under specific conditions to execute arbitrary code. This situation can significantly compromise the confidentiality, integrity, and availability of the system, posing potential risks for affected users.

Affected Version(s)

OPENBMC FW1060.00

References

https://www.ibm.com/support/pages/node/7283590
vendor-advisorypatch

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.