Description
IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.
Published: 2026-09-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located in the ASMI web interface of IBM Power Server firmware. An attacker who is not authenticated to the management network can send a malformed HTTPS request to ASMI, which can cause the web server to crash and potentially trigger memory corruption. When the ASMI interface restarts automatically, repeated attacks may lead to a sustained loss of access, impacting both the integrity of data and the availability of the management interface.

Affected Systems

Affected systems are IBM Power Server firmware versions FW1120.00 to FW1120.01, FW1110.00 to FW1110.31, FW1060.00 to FW1060.81 and FW950.00 to FW950.H3. These firmware releases run on IBM Power System models including Power 11 E1180, Power 10 E1080, and various Power 9 platforms such as S922, H922, S914, S924, H924, E950, and E980.

Risk and Exploitability

Based on the description, it is inferred that the attack vector is local to the management network. The CVSS score of 7.1 indicates a high severity vulnerability. EPSS is not available and the flaw is not listed in the CISA KEV catalog, so the precise exploitation probability is unknown. Because the flaw can cause a denial of service and repeated exploitation may lead to persistent downtime, the risk to critical infrastructure is significant.

Generated by OpenCVE AI on September 25, 2026 at 17:56 UTC.

Remediation

Vendor Solution

Customers with the products below should install FW1120.02(1120_171), FW1110.32(1110_138) or newer to remediate this vulnerability. Power 11 1) IBM Power System E1180 (9080-HEU) Customers with the products below should install FW1060.82(1060_189) or newer to remediate this vulnerability. Power 10 1) IBM Power System E1080 (9080-HEX) Customers with the products below should install FW950.H4(950_236) or newer to remediate this vulnerability. Power 9 1) IBM Power System S922 (9009-22G) 2) IBM Power System H922 (9223-22S) 3) IBM Power System S914 (9009-41G) 4) IBM Power System S924 (9009-42G) 5) IBM Power System H924 (9223-42S) 6) IBM Power System E950 (9040-MR9) 7) IBM Power System E980 (9080-M9S) The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/

Vendor Workaround

Protect access to the network interface by operating it on a private network or behind a firewall.

OpenCVE Recommended Actions

  • Apply the vendor-provided firmware update: install FW1120.02(1120_171) or newer for Power 11, FW1110.32(1110_138) or newer for Power 10, and FW950.H4(950_236) or newer for Power 9, which removes the vulnerable ASMI code.
  • Limit exposure of the ASMI interface by placing it on a private network segment or placing it behind a firewall, as suggested in the workaround.
  • Monitor the system logs for repeated ASMI crashes or error logs indicating memory corruption, and apply any new patches promptly.

Generated by OpenCVE AI on September 25, 2026 at 17:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm power System E1080 \(9080-hex\)
Ibm power System E1080 \(9080-hex\) Firmware
Ibm power System E1180 \(9080-heu\)
Ibm power System E1180 \(9080-heu\) Firmware
Ibm power System E950 \(9040-mr9\)
Ibm power System E950 \(9040-mr9\) Firmware
Ibm power System E980 \(9080-m9s\)
Ibm power System E980 \(9080-m9s\) Firmware
Ibm power System H922 \(9223-22s\)
Ibm power System H922 \(9223-22s\) Firmware
Ibm power System H924 \(9223-42s\)
Ibm power System H924 \(9223-42s\) Firmware
Ibm power System S914 \(9009-41g\)
Ibm power System S914 \(9009-41g\) Firmware
Ibm power System S922 \(9009-22g\)
Ibm power System S922 \(9009-22g\) Firmware
Ibm power System S924 \(9009-42g\)
Ibm power System S924 \(9009-42g\) Firmware
CPEs cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*
Vendors & Products Ibm power System E1080 \(9080-hex\)
Ibm power System E1080 \(9080-hex\) Firmware
Ibm power System E1180 \(9080-heu\)
Ibm power System E1180 \(9080-heu\) Firmware
Ibm power System E950 \(9040-mr9\)
Ibm power System E950 \(9040-mr9\) Firmware
Ibm power System E980 \(9080-m9s\)
Ibm power System E980 \(9080-m9s\) Firmware
Ibm power System H922 \(9223-22s\)
Ibm power System H922 \(9223-22s\) Firmware
Ibm power System H924 \(9223-42s\)
Ibm power System H924 \(9223-42s\) Firmware
Ibm power System S914 \(9009-41g\)
Ibm power System S914 \(9009-41g\) Firmware
Ibm power System S922 \(9009-22g\)
Ibm power System S922 \(9009-22g\) Firmware
Ibm power System S924 \(9009-42g\)
Ibm power System S924 \(9009-42g\) Firmware

Sat, 26 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.
Title This Power System update is being released to address
First Time appeared Ibm
Ibm server Firmware
Weaknesses CWE-125
CPEs cpe:2.3:a:ibm:server_firmware:fw1060.00.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1060.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1060.81.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1060.81:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1110.00.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1110.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1110.31.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1110.31:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1120.00.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1120.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1120.01.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw1120.01:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw950.00.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw950.h3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:server_firmware:fw950.h3:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm server Firmware
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Ibm Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) Power System E1180 \(9080-heu\) Firmware Power System E950 \(9040-mr9\) Power System E950 \(9040-mr9\) Firmware Power System E980 \(9080-m9s\) Power System E980 \(9080-m9s\) Firmware Power System H922 \(9223-22s\) Power System H922 \(9223-22s\) Firmware Power System H924 \(9223-42s\) Power System H924 \(9223-42s\) Firmware Power System S914 \(9009-41g\) Power System S914 \(9009-41g\) Firmware Power System S922 \(9009-22g\) Power System S922 \(9009-22g\) Firmware Power System S924 \(9009-42g\) Power System S924 \(9009-42g\) Firmware Server Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-26T22:51:18.861Z

Reserved: 2026-09-17T17:01:08.321Z

Link: CVE-2026-93306

cve-icon Vulnrichment

Updated: 2026-09-26T22:48:27.641Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T15:17:56.943

Modified: 2026-09-30T15:32:33.707

Link: CVE-2026-93306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T12:00:12Z

Weaknesses