IBM Power Systems Firmware EUVD-2026-119742

Exploitation requires adjacent-network access (AV:A) - the attacker must be on the same local/management network segment as the affected OpenBMC baseboard management controller or Hardware Management Console, not the open internet. No authentication (PR:N) and no user interaction (UI:N) are needed once that network position is held. Affected builds are IBM Power Systems Firmware FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, OP940.00-OP940.A2, OP910.00-OP910.95, and OP940.00-OP940.82. The primary limiting factor is network reachability of the management plane: environments that isolate or segment the BMC/HMC network sharply reduce exposure. Impact is confined to availability (denial of service); there is no confidentiality or integrity impact. A vendor patch is available and is the stated remediation.

This is a moderate-severity denial-of-service issue (CVSS 6.5) affecting IBM Power Systems Firmware management components. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H shows adjacent-network attack vector (not fully remote/internet-facing), low attack complexity, no privileges, and no user interaction, with impact limited strictly to availability (C:N/I:N/A:H) - consistent with the CWE-908 'use of uninitialized resource' DoS described. The vuln.today decision label is 'this_month', indicating a prioritize-but-not-emergency posture. No EPSS score, no KEV listing, and no PoC/exploit reference are present in the input, so there is no signal of active or imminent exploitation; the key real-world risk constraint is the AV:A requirement, meaning an attacker must already have access to the BMC/HMC management network rather than the open internet. The practical priority is driven more by the sensitivity of the management plane (OpenBMC / Hardware Management Console) than by exploitation likelihood: a successful attack degrades availability only (no data exposure or integrity loss), and exposure depends heavily on whether the management network is properly segmented. Missing data to note: no EPSS probability and no SSVC exploitation/automatable values were supplied, so exploitation likelihood is inferred solely from CVSS and the absence of KEV/PoC signals.

An attacker positioned on the same management/BMC network segment as an affected IBM Power system sends crafted input to the OpenBMC or Hardware Management Console firmware service, triggering improper handling of an uninitialized resource. This causes a denial of service that disrupts management-plane availability. No public exploit code is identified in the available data, and the adjacent-network requirement (AV:A) limits exploitation to attackers who already have a foothold on the management network.