Description
IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.
Published: 2026-11-08
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

An unhandled exception in IBM Power Systems firmware versions FW1060.00 through FW1060.81 permits a remote attacker to cause a denial of service. The description does not reference any confidentiality or integrity impacts.

Affected Systems

Affected systems include IBM Power Systems equipped with OpenBMC firmware between FW1060.00 and FW1060.81. Products specifically listed are IBM Power System S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012. Firmware FW1060.82(1060_195) or newer contains the mitigation.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the CVE is not listed in CISA KEV, suggesting no known active exploitation. Based on the description, it is inferred that a remote attacker must reach the BMC’s network interface to trigger the exception. No explicit authentication or privilege escalation is mentioned in the provided data.

Generated by OpenCVE AI on November 8, 2026 at 21:21 UTC.

Remediation

Vendor Solution

Customers with the products below should install FW1060.82(1060_195) or newer to remediate this vulnerability. Power 10 1) IBM Power System S1022 (9105-22A) 2) IBM Power System S1024 (9105-42A) 3) IBM Power System S1022s (9105-22B) 4) IBM Power System S1014 (9105-41B) 5) IBM Power System L1022 (9786-22H) 6) IBM Power System L1024 (9786-42H) 7) IBM Power System E1050 (9043-MRX) 8) IBM Power System S1012 (9028-21B) The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/

Vendor Workaround

Protect access to the BMC's network interface by operating it on a private network or behind a firewall.

OpenCVE Recommended Actions

  • Update the affected Power Systems to firmware FW1060.82(1060_195) or later
  • Restrict BMC network access by configuring the interface on a private network segment or behind a firewall
  • Monitor BMC logs for abnormal restarts or crashes that could indicate exploitation attempts

Generated by OpenCVE AI on November 8, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.
Title This Power System update is being released to address
First Time appeared Ibm
Ibm openbmc
Weaknesses CWE-248
CPEs cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm openbmc
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Openbmc
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T19:15:22.602Z

Reserved: 2026-07-25T06:10:33.753Z

Link: CVE-2026-17426

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T20:17:24.510

Modified: 2026-11-08T20:17:24.630

Link: CVE-2026-17426

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T21:30:17Z

Weaknesses