IBM OpenBMC CVE-2026-18849

Exploitation requires all of the following to be simultaneously true: (1) the attacker must hold authenticated administrator-level credentials for the IBM OpenBMC interface - CVSS PR:H confirms that high-privilege authentication is a hard prerequisite, not merely a risk-reducing factor; (2) the BMC firmware version must fall within FW1060.00 through FW1060.80; (3) the attacker must be positioned on the adjacent network segment hosting the BMC management interface (CVSS AV:A), typically an isolated IPMI or out-of-band management VLAN not reachable from the internet; (4) the firmware update feature must be accessible through the BMC interface, which is standard functionality and not a non-default configuration. The vendor's phrase 'under specific conditions' introduces additional undisclosed prerequisites not fully enumerated in public data - these limit exploitation to a narrower subset of configurations than the CVSS vector alone suggests. Exploitation is definitively NOT possible without valid administrator credentials, and remote internet-based exploitation is definitively NOT possible due to the adjacent network constraint.

The CVSS 3.1 base score of 6.8 (Medium) accurately reflects a constrained but high-impact risk profile. The adjacency requirement (AV:A) confines attacker positioning to the BMC management network segment - typically an isolated IPMI or out-of-band management VLAN - blocking opportunistic internet-based exploitation. The High Privileges prerequisite (PR:H) means the attacker must already hold valid BMC administrator credentials, making this a post-compromise lateral movement or privilege escalation vector rather than an initial access path. Attack Complexity is Low (AC:L), so once the prerequisites are met, exploitation is not technically demanding. The high CIA impact (C:H/I:H/A:H) reflects the severity of BMC-level code execution: full hardware control, firmware persistence, and potential for supply-chain-style implants. No EPSS score was provided in the input; no KEV listing and no confirmed POC code are present at time of analysis, further depressing real-world exploitation probability. The vendor's 'under specific conditions' qualifier in the description suggests undisclosed environmental prerequisites beyond what the CVSS vector captures - this ambiguity should be resolved by consulting the IBM advisory directly before drawing final conclusions about exploitability.

An attacker who has obtained BMC administrator credentials - through credential theft from a management workstation, phishing of a systems administrator, or lateral movement from a compromised host with stored BMC credentials - connects to the target BMC management interface from the adjacent management network. The attacker submits a specially crafted firmware update package embedding path traversal sequences that direct file writes outside the intended update staging directory, overwriting a critical BMC component or planting a malicious executable. Upon processing, the BMC executes the injected payload, granting the attacker persistent, OS-independent control over the server hardware. No public exploit code has been identified at time of analysis.