IBM Power Firmware CVE-2026-17427

Requires adjacent-network access to the management interface of IBM Power Systems firmware (FW1060.00-FW1060.81, OP940.00-OP940.A2, OP910.00-OP910.95) exposed via OpenBMC or the Power Hardware Management Console - the CVSS AV:A means a remote-over-the-internet attacker cannot reach it directly; the attacker must sit on the same logical/management network segment. No authentication (PR:N) and no user interaction (UI:N) are needed once adjacency is achieved. Limiting factors: the impact is denial of service only (C:N/I:N - no data disclosure or code execution), and exploitation is constrained to the management plane, so environments that isolate OpenBMC/HMC on a dedicated out-of-band network sharply reduce exposure. The specific crafted input that triggers the input-length validation failure is not detailed in the available sources.

This is a moderate-severity availability-only flaw. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates an adjacent-network attacker with no authentication and no user interaction can cause a denial of service, but with no confidentiality or integrity impact (C:N/I:N). The adjacent-network vector (AV:A, not AV:N) is the single most important limiting signal: the attacker must already have a foothold on the same logical network segment as the OpenBMC/HMC management interface, which in well-segmented environments is an isolated out-of-band management network. No EPSS score, SSVC exploitation-automatable metrics, or KEV data were supplied; there is no public exploit identified at time of analysis. The vendor's own priority label is 'this_month', not act_now or emergency, which is consistent with a management-plane DoS that is serious but not a widespread automated-exploitation risk. Net: treat as a routine-but-prompt patch for exposed management networks, not a drop-everything emergency. No conflicting signals were detected in the input, though the absence of EPSS/KEV/POC data means real-world exploitation likelihood cannot be quantified beyond the CVSS vector.

An attacker with access to the same management network segment as an IBM Power OpenBMC or Hardware Management Console interface sends a crafted request containing an improperly bounded input length, triggering the input-length validation flaw and crashing or hanging the affected firmware service, denying management access to the Power system. No authentication or user interaction is required (PR:N/UI:N), but the attacker must be adjacent to the target (AV:A). No public proof-of-concept or exploit code was identified in the provided sources.