Power Systems Firmware CVE-2026-17063

Exploitation requires an attacker to hold an active service account or root-level credential on the IBM FSP/BMC management interface - confirmed by CVSS PR:H. Access to the BMC management network (out-of-band network, IPMI/HMC connectivity) is required, consistent with AV:L. The vulnerability is at the interface between the FSP and the host processor subsystem, meaning the FSP must be managing an active host system with running partitions to achieve the full C:H/A:H impact. Limiting factors: the requirement for pre-existing privileged BMC/FSP credentials is the primary constraint; environments with tightly controlled out-of-band management networks, strong FSP credential hygiene, and no shared service accounts have substantially reduced realistic exposure. The host-side and LPAR-side workloads do not need to take any action for impact to occur once the FSP-side attack succeeds.

The CVSS 7.9 High score is appropriate in context: AV:L reflects that BMC/FSP access is a prerequisite, effectively limiting the initial attack surface to the management network or physical access, while PR:H confirms that a service account or root credential on the FSP is required - a significant barrier that materially reduces opportunistic exploitation risk. However, the S:C (scope change) combined with C:H and A:H signals that once those prerequisites are met, an attacker can break out of the management-plane boundary into the host processor, affecting all hosted LPARs simultaneously. This lateral blast radius elevates real-world impact for environments where BMC credentials are shared, weakly protected, or exposed via out-of-band management networks. No EPSS score was provided, so exploitation probability cannot be quantified; absence from CISA KEV and no identified POC suggest this has not been actively weaponized. The authentication bypass tag in the source data warrants attention: it likely refers to the authorization bypass at the BMC-to-host interface level (consistent with CWE-863), not a bypass of BMC login - the CVSS PR:H vector confirms BMC credentials are still required. Overall assessment: real priority for organizations operating IBM Power Systems with multi-tenant LPAR deployments, lower urgency for single-tenant or air-gapped deployments where FSP access is tightly controlled.

An attacker who has obtained service account credentials for the FSP management interface - for example via credential theft, default credential reuse on the out-of-band management network, or a compromised management workstation - connects to the FSP and issues unauthorized commands targeting the BMC-to-host processor interface. Exploiting the CWE-863 incorrect authorization flaw, the attacker reads sensitive host processor state (memory registers, partition data) and injects disruptive operations, causing availability loss across all LPARs on the managed system simultaneously. No public proof-of-concept has been identified, but the low attack complexity (AC:L) once BMC access is achieved suggests a technically straightforward exploitation path for an experienced attacker.