Power Systems Firmware CVE-2026-16835

Exploitation requires network adjacency to the FSP management network (AV:A) - the attacker must be able to reach the Flexible Service Processor's management protocol endpoint, typically the isolated HMC/service-processor VLAN, rather than the production or public network. Given PR:N/UI:N/AC:L, once on that network no credentials, no user interaction, and no non-default configuration are needed against the listed firmware levels; the improper certificate validation (CWE-295) allows the authentication step to be bypassed directly. The key limiting factor is therefore management-network reachability: environments that strictly segment and access-control the FSP/HMC network sharply reduce exposure, while flat or poorly-segmented management networks leave the flaw trivially reachable across all listed vulnerable firmware trains.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes a low-complexity, unauthenticated attack requiring only adjacency to the management network, with a scope change reflecting that compromise of the FSP cascades to all managed partitions - a genuinely severe combination. The AV:A (adjacent) restriction is the primary mitigating factor: the attacker must already have a foothold on the isolated FSP/management VLAN, so this is not an internet-wide, spray-and-pray exposure. No EPSS score, SSVC decision, POC, or KEV entry was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC suggests no confirmed active exploitation at this time, but the trivial complexity and total-control impact mean any attacker who reaches the management network gains crown-jewel access. Net: treat as a high-priority patch for any environment where management-network segmentation cannot be fully guaranteed, while recognizing the realistic blast radius is bounded by who can reach the FSP network.

An attacker who has gained a foothold on the FSP management VLAN - for example via a compromised HMC, a misconfigured management switch, or a rogue device plugged into the management segment - speaks the FSP management protocol and bypasses the certificate-validation-based authentication. With that access they power off or reconfigure production partitions and attach to partition consoles to read or manipulate hosted workloads. No public exploit identified at time of analysis, and the low attack complexity means a working technique against the management protocol would require no special timing or race conditions.