EUVD-2026-97866
GHSA-cxch-p56r-27hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated FSP service access
-
DeliveryWrite crafted firmware configuration data
-
ExploitTrigger stack overflow during system IPL
-
ExecutionCorrupt host firmware boot stack
-
ImpactCompromise hypervisor and managed system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated service-level access to the Flexible Service Processor (FSP) management interface of an IBM Power system running firmware FW1060.00 through FW1060.81. The attacker must be able to write host-firmware configuration data, and the memory corruption is only triggered during the host firmware boot stage at system IPL (initial program load) - meaning exploitation depends on a (re)boot cycle, not runtime. Limiting factors: this is not network-exploitable (local FSP access only), demands high privilege (valid FSP service credentials), affects only the specified FW1060.x firmware band, and no user interaction on the managed OS is involved. Defenders should treat FSP/management-network segmentation and service-account control as the primary compensating controls. |
| Impact | The CVSS 3.1 base score of 8.2 (vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability compromise with a scope change - the corruption originates in host firmware but propagates to the separately-managed hypervisor and managed system, which justifies S:C. The single most important mitigating signal is PR:H: exploitation requires authenticated service-level access to the Flexible Service Processor (FSP), a privileged out-of-band management plane, and the vector is local (AV:L), not network-reachable. No EPSS score is provided in the input, so exploitation probability cannot be quantified. This is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: technical impact is Total (firmware/hypervisor compromise), but automatability is low because an attacker must already hold privileged FSP service credentials and act during a system IPL - this points to a targeted, insider-or-post-compromise scenario rather than mass exploitation. Net: a genuinely high-impact firmware flaw, but the PR:H + AV:L prerequisites make it a lower immediate-priority item than a network-facing unauthenticated bug of the same score. No conflicting signals detected between the CVSS vector and the description - both agree on local, high-privilege access. |
| Exploit ScenarioDerived | An attacker who has already obtained authenticated service-level credentials to the FSP (e.g., a malicious operator, or an adversary who pivoted to the management network) writes specially crafted host-firmware configuration data. On the next system IPL, the firmware's configuration parser overflows a stack buffer during the boot stage, allowing the attacker to corrupt the host firmware boot stack and subvert the hypervisor loaded afterward. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Memory corruption in IBM Power Systems host firmware FW1060.00 through FW1060.81 lets an attacker who already holds authenticated, high-privileged service-level access to the Flexible Service Processor (FSP) write crafted configuration data that corrupts the host firmware boot stack during system IPL, with the compromise then propagating to the hypervisor loaded by that firmware and to the managed system. Because the flaw is reachable only from the local FSP interface (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) and only fires on a (re)boot cycle rather than at runtime, the practical attack path is an insider or compromised FSP service account on the management plane rather than a remote network attacker, and no public exploit identified at time of analysis and no CISA KEV listing is associated with this CVE. Full confidentiality, integrity, and availability impact is scored against the managed system, with a scope change reflecting that the corruption begins in host firmware but affects the separately-managed hypervisor.
RemediationAI
The primary fix is to move affected Power systems off the FW1060.00-FW1060.81 firmware band by applying the corrected firmware level documented in IBM's advisory at https://www.ibm.com/support/pages/node/7290128; the input data does not specify an exact fixed firmware version, so confirm the target level in that IBM support page before scheduling the update, and note that a firmware flash is itself disruptive and typically requires an IPL. Until the fixed level is applied, the highest-value compensating control is to tightly restrict who can authenticate to the FSP: disable or rotate unused service accounts, enforce least privilege so that only a small set of administrators can write host firmware configuration data, and enable and monitor FSP audit logging for unexpected configuration writes. Treat the FSP/management network as a distinct trust zone - segment it away from general user networks, block inbound access to FSP management interfaces from anything other than a hardened administrative jump host, and prefer out-of-band management paths that are not reachable from the managed system - because the vulnerability is only reachable from the local FSP interface and not from the network, this segmentation materially raises the cost of exploitation without patching. The trade-off is administrative overhead: restricted FSP access and segmented management networks slow routine maintenance and can complicate out-of-band recovery, so document break-glass procedures in advance. Finally, because corruption manifests only at the host firmware boot stage during IPL, an unexpected failure or anomalous behavior of a host at boot on a system with recent FSP configuration changes should be investigated as a possible indicator, and incident response should assume the hypervisor may have been tampered with if a malicious configuration write is detected.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-121, stack-based buffer overflow, occurring in the host firmware's parsing of configuration data supplied through the Flexible Service Processor (FSP), the service processor that manages Power Systems hardware independently of the host OS. Input that reaches the parser during the host firmware boot stage at IPL is not correctly bounds-checked, so an oversized or malformed configuration blob overwrites adjacent stack memory of the boot-stage code. Because this code runs before and beneath the hypervisor, control over it means control over the subsequently loaded hypervisor and, through it, the managed system - which is why the CVSS vector carries S:C (scope change) alongside C:H/I:H/A:H. The parsing path is not exposed on the network and is not reachable from the managed OS; it requires write access to host firmware configuration as an authenticated FSP service-level principal, and the corruption is only realized on the next IPL rather than in a live runtime context. The affected firmware band is specifically FW1060.00 through FW1060.81.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
FSP service access is local and privileged, so AV:L and PR:H; firmware compromise propagates to the hypervisor/managed system, giving S:C with full C:H/I:H/A:H.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
Executive ViewAI
IBM Power Systems host firmware FW1060.00 through FW1060.81 has a high-severity memory corruption vulnerability that can compromise the managed system and its hypervisor when an authenticated, high-privileged FSP service account is abused and the system is rebooted; leadership should care because a successful event could affect all workloads on the managed system, though the path requires insider or compromised management-plane credentials rather than remote network access. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so the organization should treat FSP access as a high-risk control point until IBM provides remediation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting and auditing Flexible Service Processor (FSP) service-level access, enforcing least privilege and multifactor authentication where supported for management-plane accounts, rotating FSP credentials, isolating the FSP management interface, monitoring for unauthorized configuration changes, and tightly governing IPL/reboot windows for IBM Power Systems host firmware FW1060.00 through FW1060.81.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB