IBM Power Systems Firmware CVE-2026-17429

Exploitation requires service account or root-level access to the IBM Power Systems BMC or FSP management interface (CVSS PR:H, AV:L). The attack operates through the host-to-BMC/FSP interface rather than over a general network path, so physical or logical management plane access is a hard prerequisite. No additional non-default firmware configuration is described as necessary beyond possessing the necessary BMC/FSP credentials - the vulnerable register-write path is part of standard BMC/FSP functionality. Exploitation is limited by the requirement for high-privilege BMC/FSP credentials, making this irrelevant against externally-facing attack surfaces and inapplicable to unprivileged host OS users. Defenders assessing risk should focus on who holds FSP/BMC service or root access and whether the management network is adequately segmented.

The vendor-supplied CVSS base score of 8.1 is driven primarily by the Scope:Changed (S:C) metric, which reflects that BMC/FSP compromise translates directly into full host system and LPAR takeover - an extreme impact amplifier. However, several signals substantially constrain real-world attack surface: the vector is Local (AV:L) and privileges required are High (PR:H), meaning exploitation requires an actor who already holds elevated BMC/FSP credentials. This is not a remote unauthenticated threat and is most relevant in insider-threat, supply chain, or post-breach scenarios where the management plane has already been accessed. No EPSS score was provided and the vulnerability does not appear in CISA KEV, so no confirmed active exploitation exists. Notably, the vendor-supplied C:L (partial confidentiality) metric conflicts with the description of 'full control over the host system and all hosted partitions' - full control canonically implies C:H; defenders should treat confidentiality impact as likely high and seek clarification from IBM. SSVC signals: exploitation status unproven, not automatable given the PR:H prerequisite, technical impact is total if the management plane is reachable.

An attacker who has acquired BMC/FSP service account or root credentials - via credential theft from a management workstation, exposed default credentials on an insufficiently hardened management network, or lateral movement from a previously compromised host - connects to the FSP/BMC interface and issues write operations to hardware control registers that should be restricted to firmware internals. Bypassing the insufficient authorization check, the attacker rewrites control register values to seize full control of the host Power System and every LPAR, enabling persistent implantation below the OS layer, bulk data exfiltration from all partitions, or complete workload destruction.