IBM Power Firmware CVE-2026-19234

Exploitation requires an account with service access to the IBM Power service processor - this is the explicit prerequisite stated in the CVE description. This typically means access to the Hardware Management Console (HMC), Intelligent Platform Management Interface (IPMI), or equivalent IBM service channel at a high-privilege level, consistent with PR:H in the CVSS vector. The attack is delivered via a crafted code update image supplied through the firmware update mechanism during or triggering the host boot process image validation path. Exploitation is limited to: (1) accounts holding service processor credentials at an administrative level, (2) systems running one of the three specified firmware trains (FW1120.00, FW1110.x, FW1060.x), and (3) environments where the firmware update interface is reachable. Default installations with properly secured, network-isolated BMC/service processor management interfaces significantly constrain the attack surface.

The CVSS 8.2 score reflects a scope-changed, high-impact vulnerability (C:H/I:H/A:H) but is moderated by AV:L and PR:H - physical or privileged service access is required, significantly narrowing the exploitable population. The scope change metric is the most consequential signal here: code executed via the service processor can subvert host-level security controls including secure boot and hypervisor integrity, making this a firmware-level implant vector. No EPSS data was provided, and the absence of KEV listing and public POC suggests exploitation has not been observed at scale; however, the attack profile - a trusted insider or compromised service account with BMC/service processor access - aligns with advanced persistent threat and supply chain attack patterns. Even a mid-sized enterprise IT operation in radom hypothetically running IBM Power infrastructure should treat this as urgent given the persistence and stealth potential of firmware-level compromise, even though real-world exploitation probability for most environments is constrained by the PR:H prerequisite. CVSS indicates local vector consistent with the description's service processor access requirement - no conflict detected.

An attacker who has compromised a service account with IBM Power service processor access - either through credential theft, insider threat, or lateral movement from an HMC management host - crafts a malformed firmware update image that triggers a stack-based buffer overflow in the image validation routine. The overflow redirects execution to attacker-supplied shellcode running at service processor privilege level, from which the attacker can implant persistent firmware backdoors or manipulate host boot integrity, surviving OS reinstallation. No public POC is known at this time.