IBM Power Firmware CVE-2026-17093

Exploitation requires service-level access to the BMC/FSP management interface of an IBM Power system running one of the affected firmware versions. 'Service-level access' in IBM Power terminology refers to elevated management credentials (above standard operator level) that permit submission of firmware configuration data - this is a non-default, privileged role typically held by system administrators or IBM service personnel. A reboot or firmware boot cycle must occur after the malicious configuration is supplied, as the vulnerable parsing occurs at the boot stage rather than at runtime. Factors limiting exploitation: authentication is required at high privilege (CVSS PR:H); attack vector is local (AV:L), ruling out remote unauthenticated exploitation; and the attacker must already control a management-plane account on the targeted IBM Power system. Non-default configuration is not required beyond having an account with service-level BMC/FSP access.

The CVSS 8.2 score reflects a Scope Changed scenario with full C/H/I/H/A/H impact, but the gating factor is PR:H - service-level access to the BMC/FSP, which is a significant prerequisite that substantially narrows the realistic attacker population. The local attack vector (AV:L) further confirms that remote unauthenticated exploitation is not supported by the CVSS data. Real-world risk is therefore highest for environments where BMC/FSP service accounts are broadly shared, insufficiently restricted, or exposed to insider threat and supply-chain adversaries. The vulnerability is not listed in the CISA KEV catalog, no public exploit code has been identified, and no EPSS data was provided in the input - making quantified exploitation probability unavailable. Despite the high severity score, this is not a spray-and-pray network-exploitable flaw; exploitation requires a highly privileged foothold in the management plane, making it a targeted rather than widespread threat. The boot-chain compromise potential is severe: successful exploitation persists below the OS layer and is extremely difficult to detect or remediate without full firmware re-flashing.

An adversary who has obtained service-level credentials to the BMC/FSP management interface - whether through credential theft, insider threat, or prior compromise of an admin workstation - supplies a maliciously crafted firmware configuration payload. During the subsequent boot cycle, the Power Firmware configuration parser processes the crafted data, triggers a stack-based buffer overflow, and cedes control of the boot stage to attacker-controlled code. Every component loaded thereafter - hypervisor, OS kernel, workloads - executes in a compromised trust environment, giving the attacker persistent, below-OS-level control of the managed system. No public proof-of-concept has been identified, but the attack chain is mechanically straightforward for an actor with BMC/FSP access.