Power Systems Firmware CVE-2026-16832

Exploitation requires two simultaneous prerequisites: (1) authenticated HMC administrator access - PR:H in the CVSS vector confirms high-privilege credentials are mandatory, meaning an unprivileged or low-privilege user cannot trigger this vulnerability; and (2) adjacency to the FSP management network (AV:A), meaning the attacker must be on the dedicated out-of-band management segment and cannot exploit this from the internet, general corporate LAN, or hosted LPARs. The vulnerability is in the FSP management network protocol specifically, so the FSP must be reachable from the attacker's network position. Limiting factors are significant: HMC administrator credentials represent a high-trust role (typically restricted to a small team), and the management network is often air-gapped or VLAN-isolated in security-conscious deployments. Default-secure configurations that properly segment the management network substantially reduce risk. Exploitation is not possible from hosted operating systems or general network access without management-network adjacency.

The CVSS 8.4 score is technically well-calibrated: S:C (scope change) drives the high base score because FSP compromise cascades to all managed LPARs and physical hardware, while AV:A and PR:H appropriately constrain the realistic attacker population to those with both management-network adjacency and HMC administrator credentials. Real-world exploitation therefore requires either a malicious insider, a compromised privileged account, or an attacker who has already breached the out-of-band management network - a substantially higher bar than a network-exploitable, unauthenticated flaw. EPSS data is absent from the provided intelligence, and neither a CISA KEV listing nor a public POC is confirmed, suggesting this has not yet seen opportunistic exploitation. The CVSS vector and vendor description are internally consistent with no conflicting signals. Despite the elevated privilege requirement, the blast radius upon successful exploitation is severe: a single compromised HMC administrator credential could yield full, persistent, hypervisor-level control over an entire Power Systems environment. Organizations operating IBM Power infrastructure in enterprise or government data centers should prioritize patching within their normal critical-patch cycle, with particular attention to hardening HMC administrator account controls and management-network segmentation as compensating measures.

An attacker who has obtained HMC administrator credentials - through phishing, credential reuse, or insider access - connects to the FSP management network and transmits a specially crafted FSP protocol message. The malformed message triggers a stack-based buffer overflow in the firmware's protocol handler, overwriting a return address and redirecting execution to attacker-supplied shellcode running on the service processor. From this position, the attacker has persistent, OS-independent control over all logical partitions and hardware resources on the managed Power Systems chassis. No public POC is known at time of analysis.