Power Systems Firmware CVE-2026-16933

Exploitation requires an attacker to already hold a service account or root-level credential on the BMC/FSP management processor - this is the critical gatekeeping condition. The attack vector is local (AV:L), meaning the attacker must have access to the BMC/FSP interface, which is typically exposed only on a dedicated management network or via direct physical connection. The vulnerability exists in the interface between the BMC/FSP and the host system regardless of host OS configuration, meaning no special host-side configuration is required once BMC/FSP access is obtained. Limiting factors include: (1) PR:H - requires service account or root on the management processor, not merely network adjacency; (2) AV:L - management network segmentation raises the bar significantly; (3) UI:N - no user interaction required, so once credentials are available exploitation is immediate and silent. The affected product versions span FW950 through FW1120 and OP940, so unpatched systems across all these trains are vulnerable.

The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H scores 8.2 and accurately reflects the attack profile: local vector with high privilege required on the BMC/FSP, but scope change (S:C) captures the critical escalation from the management plane to the host system. The high privilege requirement (service account or root on the BMC/FSP, not the host OS) is the primary limiting factor - it confines initial attacker footprint to those with legitimate or compromised management-plane access. However, once that bar is cleared, the attack is low-complexity (AC:L) and requires no user interaction. There is no EPSS data provided, no CISA KEV listing, and no public proof-of-concept identified; risk is therefore driven primarily by CVSS signals and the severity of the scope-change impact rather than observed exploitation activity. In environments running IBM Power systems in multi-tenant or shared hosting configurations (common in financial and government sectors), the potential to compromise all hosted LPARs from a single BMC credential makes this a high-priority remediation despite the elevated privilege prerequisite. The integer overflow root cause (CWE-190) is a well-understood and reliably exploitable class once an attacker reaches the vulnerable interface.

An attacker who has obtained service account or root credentials to an IBM Power system's BMC/FSP management interface - whether through credential theft, a compromised jump host, or insider access - sends a crafted memory operation request that triggers the integer overflow in the FSP-to-host interface boundary logic. The overflow causes the firmware to service read and write operations against arbitrary physical memory addresses on the host system, allowing the attacker to extract cryptographic keys, credentials, or sensitive data from running LPARs, or to inject malicious code into the host OS or hypervisor, achieving complete host compromise across all partitions. No public proof-of-concept is known, but the attack primitive (crafted BMC/FSP interface call exploiting CWE-190) is within reach of an attacker with firmware reversing capability.