IBM Power Systems Firmware CVE-2026-16930

Exploitation requires the attacker to already hold service account or root-level access to the BMC or FSP management controller of the affected IBM Power system - this is a high-privilege prerequisite that limits the attack surface to authorized operations personnel, compromised management credentials, or attackers who have achieved a prior foothold in the out-of-band management network. The affected firmware versions (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80) must be running on the target system. No special non-default configuration beyond having a BMC/FSP (which is standard on all IBM Power Systems) is required. Exploitation is limited by: (1) the PR:H prerequisite - BMC/FSP privileged credentials must be obtained; (2) network or physical access to the BMC management interface; (3) specific vulnerable firmware versions. The attack does not require user interaction on the host side and has no UI:N dependency beyond initial BMC authentication.

The CVSS 3.1 score of 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H accurately reflects the attack profile: local access to the BMC management plane is required, but once that threshold is crossed, the attack is low-complexity and delivers full CIA impact across the host and all hosted partitions. The PR:H prerequisite is the critical limiting factor - exploitation is gated behind service account or root access to the BMC or FSP, which is typically restricted to data center operations staff, hardware vendors, or attackers who have already compromised a privileged management account. No EPSS score was provided in the input, preventing probabilistic exploitation forecasting. No CISA KEV listing exists, and no public proof-of-concept has been identified, so real-world exploitation risk is presently assessed as theoretical but high-consequence. For organizations running IBM Power infrastructure in sensitive roles - financial services, government, or critical national infrastructure - the blast radius (full host takeover plus all LPARs) justifies urgent remediation regardless of the absence of observed exploitation. No conflicting signals between CVSS and the description were detected; the local attack vector is consistent with the BMC-access prerequisite described.

An attacker who has compromised a data center technician's BMC service account - via phishing, credential theft from an IT management system, or insider threat - authenticates to the FSP management interface of an IBM Power server. By sending crafted commands across the BMC-to-host interface that lack proper authorization enforcement, the attacker executes arbitrary code on the host operating system with elevated privileges. With host-level access, all logical partitions (LPARs) running on that physical server - potentially dozens of guest workloads - are fully compromised. No public proof-of-concept has been identified.