Power Systems Firmware CVE-2026-96263

Exploitation requires the attacker to already possess service access to the service processor (the hardware management controller) of an affected IBM Power system, and to be able to supply a maliciously crafted code update image that is processed by the host firmware boot-process image-validation path. The limiting factors are substantial: the attacker needs high privileges (PR:H) on the service processor and local/service-level access (AV:L) rather than network reachability, and only systems running the affected firmware levels (FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81) are vulnerable. No end-user interaction is required (UI:N) once service access is held, and no non-default feature toggle is needed - the vulnerable path is the standard firmware update/validation flow.

The CVSS 3.1 base score of 8.2 (High) is driven largely by the scope change (S:C) and full C:H/I:H/A:H impact, but the exploitability metrics meaningfully temper real-world risk: AV:L requires local/service-level access and PR:H requires high privileges (service access to the service processor), so this is not a remotely reachable, unauthenticated flaw. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - the only reference is the IBM support advisory. Exploitation status is therefore 'no public exploit identified at time of analysis.' Taken together, the signals point to a serious-but-gated issue: an attacker who already holds privileged service-processor access can achieve arbitrary code execution on the host, but obtaining that access is itself a significant barrier, making this a lower immediate-priority item than its 8.2 score suggests for environments with controlled service-processor access. Note the AC:L rating implies reliable exploitation once the privilege precondition is met, so the flaw should still be patched promptly on exposed or shared-management systems.

An attacker who has obtained service access to the IBM Power service processor (for example, a malicious insider or an adversary who has pivoted onto the management network) crafts a malformed firmware code update image. When the host firmware boot process validates this image, a stack buffer overflow (CWE-121) is triggered, letting the attacker execute arbitrary code on the host system. No public exploit code is identified at the time of analysis, and exploitation requires pre-existing privileged access rather than remote interaction.