IBM PowerVM Hypervisor CVE-2026-16661

Exploitation requires authenticated service-level access to the IBM Flexible Service Processor (FSP) - a privileged management credential tier above standard HMC administrator access, typically held by IBM hardware support engineers or automation systems with explicit service-level authorization. The attack is directed at the service processor mailbox interface specifically, meaning the attacker must be able to submit mailbox messages to the FSP, which requires either physical console access, FSP Ethernet port connectivity, or access via an HMC with service-level credentials. The CVSS AV:L reflects that FSP access is logically local to the management plane rather than directly internet-exposed. Exploitation is limited by: (1) requirement for PR:H service-level FSP credentials (not standard admin), (2) FSP network ports typically isolated on a dedicated management VLAN, (3) no user interaction vector means no phishing-based delivery, and (4) only specific firmware versions in streams FW950, FW1060, FW1110, and FW1120 are affected. Systems running firmware outside these affected ranges or already patched to the fixed levels are not vulnerable.

The CVSS 8.2 score reflects the high impact (C:H/I:H/A:H) and scope change but is partially moderated by the local attack vector (AV:L) and high privilege requirement (PR:H). In practice, service-level FSP access is typically restricted to hardware administrators, IBM support engineers, and automated management platforms - this is not a broadly accessible attack surface. That said, in environments where FSP network management ports (dedicated 1GbE FSP ports) are accessible from internal networks without strong segmentation, the 'local' attack vector is effectively network-reachable by any internal actor who can authenticate at the service level. No EPSS data was provided; given the specialized access requirements and enterprise-only deployment footprint, opportunistic mass exploitation is unlikely, but targeted attacks by a compromised privileged insider or via a compromised management network represent a credible threat. The absence of CISA KEV listing and no confirmed POC lowers urgency compared to KEV-listed firmware vulnerabilities (e.g., BMC flaws in Baseboard Management Controllers). The primary risk is targeted: a threat actor who already has foothold in the management network and service-level credentials could use this to achieve persistent, firmware-level control below the OS - extremely difficult to detect and remediate. SSVC assessment: exploitation status is 'none publicly known'; automatable is 'no' (requires authenticated privileged access); technical impact is 'total' (full system compromise). SSVC priority is likely 'scheduled' patching rather than immediate emergency response for most organizations.

An attacker who has obtained service-level credentials for the FSP - either through credential theft, insider access, or compromise of an IBM Hardware Management Console (HMC) - connects to the service processor management interface and sends a crafted mailbox message designed to trigger an integer overflow in the firmware's mailbox-handling routine. The overflow corrupts firmware memory or redirects execution flow, granting the attacker arbitrary code execution within the host firmware runtime, from which they can manipulate partition configurations, disable security controls, or install persistent firmware-level implants that survive OS reinstallation. No public POC has been identified at time of analysis.