What is the CVSS score of CVE-2026-12943?

CVE-2026-12943 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of IBM HMC are affected by CVE-2026-12943?

IBM Hardware Management Console (HMC), used to manage IBM Power server infrastructure, contains a critical vulnerability allowing unauthenticated remote attackers to execute commands with elevated…. A patch is available.

How to fix or mitigate CVE-2026-12943?

Within 24 hours: Identify all HMC instances running versions 10.3.1050.0-10.3.1064.0 or 11.1.1110.0-11.1.1112.0 using asset inventory and document their role and network exposure. Within 7 days: obtain the latest patched HMC version from IBM's security advisory, validate the patch in a non-production environment, and prepare deployment procedures. Within 30 days: deploy patches to all affected production HMC systems; implement network-level access controls to restrict HMC administration interfaces to authorized management networks and jump hosts.

IBM HMC CVE-2026-12943

EUVD-2026-51260 CRITICAL

OS Command Injection (CWE-78)

2026-07-30 ibm

GHSA-hvmw-g754-cmg9

Command Injection IBM Hmc V10 3 1050 0 Hmc V11 1 1110 0

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) yielding elevated arbitrary command execution gives full C/I/A impact; scope kept Unchanged to the appliance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:50 vuln.today

CVE Published

Jul 30, 2026 - 17:57 cve.org

CRITICAL 9.8

DescriptionCVE.org

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

AnalysisAI

OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.

Technical ContextAI

The IBM HMC is the out-of-band management appliance that administers IBM Power hardware - LPAR/partition provisioning, firmware, power control, and service actions - and Novalink provides a similar management path for PowerVM/OpenStack-managed hosts. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled input reaches an underlying shell or OS command without adequate sanitization, allowing injected commands to execute in the context of the calling process. Because the HMC runs privileged management daemons, the injected commands execute with elevated privileges rather than a constrained service account. The affected CPEs identify the products as cpe:2.3:a:ibm:hmc_v10.3.1050.0 and cpe:2.3:a:ibm:hmc_v11.1.1110.0.

RemediationAI

Patch available per vendor advisory - apply the fixed IBM HMC level published in IBM's security bulletin at https://www.ibm.com/support/pages/node/7278667; the input does not specify an exact fixed build number, so confirm the target version directly from that advisory for both the V10.3.10xx and V11.1.11xx branches before scheduling maintenance. Until patched, reduce exposure by restricting network access to the HMC management interfaces to a dedicated, isolated administrative VLAN and a small allowlist of trusted admin hosts, and block HMC management ports from general/user networks - the trade-off is that overly tight filtering can interrupt legitimate automation, Novalink connectivity, or service-agent callbacks, so validate management workflows after tightening. Also review HMC access logs for anomalous command activity as a detective control.