Power Systems Firmware CVE-2026-17426

Requires adjacent-network access to the affected IBM Power Systems Firmware / OpenBMC management service (CVSS AV:A), i.e., the attacker must reach the BMC/system-management network segment rather than exploit over the open internet. No authentication (PR:N) and no user interaction (UI:N) are needed against affected versions FW1060.00 through FW1060.81. The primary limiting factors are the adjacent-network constraint (BMC management interfaces are typically segregated on an out-of-band LAN) and the availability-only impact - successful exploitation yields a denial of service only, with no confidentiality or integrity compromise. The exact request or field that triggers the unhandled exception is not described in the available sources.

This is a moderate-severity availability-only issue (CVSS 6.5) that should be treated as scheduled-maintenance work rather than an emergency, consistent with the vuln.today 'this_month' decision label. The CVSS vector is the strongest signal: AV:A (adjacent network, NOT fully remote/internet-routable), AC:L, PR:N (no authentication), UI:N, with impact limited to A:H - no confidentiality or integrity loss. There is no EPSS score, no CISA KEV listing, and no PoC reference in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a discrepancy to verify: the NVD/vendor description calls this a 'remote attacker' issue, but the CVSS vector specifies AV:A (Adjacent), implying the attacker must share the local/management network segment rather than attack from the open internet - verify the exposure model with IBM. The realistic priority is low-to-moderate: an unauthenticated adjacent attacker can crash a service via an unhandled exception (CWE-248), but the blast radius is a denial of service on a baseboard management controller, not code execution or data exposure.

An attacker with access to the BMC/system-management network segment sends a crafted request to the IBM Power Systems firmware (OpenBMC) service, triggering an unhandled exception (CWE-248) that crashes or hangs the affected component and denies management availability. No authentication or user interaction is required (PR:N/UI:N), but the attacker must be adjacent to the target (AV:A), not operating from the open internet. No public PoC or exploit code is identified in the available sources, and the specific message or field that triggers the exception is not described.