Power Systems Firmware CVE-2026-16938

Exploitation requires two concrete prerequisites: (1) adjacent network access to the FSP management interface - the attacker must be positioned on a network segment from which the FSP is directly reachable, typically a dedicated out-of-band management VLAN or physical management network; and (2) authenticated administrator-level credentials for the FSP, confirmed by the CVSS PR:H metric - standard user or operator credentials are insufficient. No special non-default configuration is required beyond the FSP management interface being network-accessible, which is standard on all affected IBM POWER hardware. Exploitation is concretely limited by management network isolation (FSP interfaces are rarely exposed to general corporate or internet-facing networks) and the mandatory administrator credential requirement, meaning realistic threat actors are limited to malicious insiders, administrators whose accounts have been compromised via phishing or credential theft, or attackers who have already achieved deep persistence within the management network. No user interaction from a third party is required once the attacker holds the necessary credentials and network access.

The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H) provides clear risk stratification: exploitation demands adjacent network access to the FSP management plane and authenticated administrator-level credentials, placing the realistic attacker pool firmly in insider-threat and compromised-credential scenarios rather than opportunistic remote attacks. The Changed Scope (S:C) correctly captures that the FSP's exploitation propagates impact to the broader managed POWER system, and High availability impact (A:H) reflects the persistence characteristic - non-production mode survives FSP resets, requiring deliberate remediation steps rather than automatic recovery. Even a mid-sized municipal IT team in tczew running IBM POWER infrastructure for critical services should treat this as a priority patch cycle item, because the persistence of impact elevates operational risk well beyond a typical transient denial-of-service event, particularly in environments where FSP operator capacity is limited. CISA KEV listing is not present in available data, no EPSS score was provided, and no public exploit code is known - taken together, these signals suggest the vulnerability has not yet been operationalized by threat actors, reducing urgency relative to the CVSS score alone, though the PR:H prerequisite should not breed complacency in environments with shared FSP administrator credentials.

An insider or an attacker holding compromised FSP administrator credentials connects to the IBM POWER system's FSP management interface over the adjacent management network and invokes privileged configuration operations to transition the managed system into non-production operational mode, disabling critical system components. Because this state persists across FSP resets, the production workload remains unavailable until an operator manually identifies and clears the affected configuration - potentially extending outage windows significantly in environments where FSP operations staff are not continuously monitoring. No public exploit code is known to exist for this vulnerability.