EUVD-2026-62840
GHSA-8pm5-m8h3-36ww
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
FSP service-level authentication required (PR:H, AV:L); S:C reflects hypervisor compromise from a lower FSP security domain; full C/I/A justified by arbitrary Hostboot memory read/write.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
AnalysisAI
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated service-level access to the FSP (Flexible Service Processor) - a privilege tier that is distinct from and more restricted than standard OS-level or hypervisor-level administrative access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H accurately reflects the attack profile: local access vector (FSP management network), low complexity once credentials are obtained, and a high privilege prerequisite (FSP service-level authentication). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained FSP service-level credentials - through credential theft from a shared service account, insider access, or compromise of an IBM management system - connects to the FSP management interface on a targeted POWER-series server. The attacker sends a specially crafted mailbox message designed to trigger an out-of-bounds read or write operation within Hostboot's memory space, corrupting the host firmware boot stack. … |
| Remediation | The primary remediation is to apply vendor-supplied firmware updates for the affected release train in use - consult the IBM advisory at https://www.ibm.com/support/pages/node/7283235 for specific patched firmware versions per release train (FW1120, FW1110, FW1060, FW950), as exact fix versions were not included in the available data and must be obtained directly from IBM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all IBM POWER systems in your infrastructure, audit FSP service processor credential distribution and access scope, and immediately move FSP interfaces to fully isolated out-of-band management networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrat
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requ
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today