IBM Power HMC CVE-2026-16697

Exploitation requires the attacker to be on an adjacent network reaching the affected component - the IBM Power Hardware Management Console (HMC) or the OpenBMC-based baseboard management controller management interface - consistent with AV:A rather than Internet-wide reach. No authentication is required (PR:N) and no user interaction is needed (UI:N), and attack complexity is low (AC:L), so no special configuration is stated as a precondition in the sources. The primary limiting factor is network adjacency: systems whose HMC/BMC management plane is isolated on a dedicated, access-controlled management VLAN are not reachable by untrusted parties, which is the main realistic constraint on exploitation. Impact is limited to availability (denial of service); there is no confidentiality or integrity impact. The specific feature or protocol path that triggers the excessive resource consumption is not described in the available sources.

This is a moderate-severity availability-only issue (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) stemming from CWE-770, improper restriction of excessive computational resources. The signals are internally consistent and point to a bounded, non-urgent priority rather than a top-tier emergency: the attack vector is Adjacent (AV:A), meaning the attacker must be on the same logically-adjacent network - typically the service/management network reaching the HMC or OpenBMC BMC - not the open Internet, which substantially narrows exposure. Complexity is low and no privileges or user interaction are required (AC:L/PR:N/UI:N), so an unauthenticated adjacent attacker can trigger it, but impact is confined to availability (C:N/I:N/A:H) with no confidentiality or integrity loss and no scope change. The vuln.today decision label is 'this_month', aligning with a plan-and-patch cadence rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no POC/exploit reference were supplied, so there is no evidence of active exploitation or available weaponization. Note the conflict worth flagging: this CVE was reported by IBM itself (vendor self-disclosure) and the description attaches very specific firmware/OP build ranges, which raises confidence in the affected-versions data, but the lack of EPSS/KEV/POC means real-world exploitation likelihood is unquantified from the input. The mechanism of the resource exhaustion is not described in the available sources. Overall: a legitimate but contained DoS requiring management-network adjacency - remediate on a normal patch cycle, prioritizing systems whose HMC/BMC management plane is reachable by untrusted parties.

An attacker with access to the management/service network segment reaching an affected IBM HMC or OpenBMC-based baseboard management controller sends requests that cause unbounded consumption of computational resources, exhausting the device and producing a denial of service against management functions. No authentication or user interaction is needed (PR:N/UI:N) and complexity is low, but the attacker must first be adjacent on that network (AV:A). No public exploit code or PoC reference was identified at time of analysis, and the specific trigger is not described in the available sources.