IBM HMC EUVD-2026-51260

The attacker needs network access to a vulnerable IBM HMC (V10.3.1050.0-10.3.1064.0 or V11.1.1110.0-11.1.1112.0) management interface and the ability to reach the input field that is improperly validated; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are required against affected default deployments. The primary limiting factor is exposure of the management plane: the HMC is intended to run on an isolated administrative network, so exploitation realistically requires that the attacker can route to the appliance's management interfaces. Version is also limiting - only the two listed HMC version bands are stated as affected.

This is a genuine high priority, not an inflated CVSS. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and the outcome - arbitrary command execution with elevated privileges - is consistent with that scoring. No EPSS score was provided in the input, and there is no KEV listing and no public exploit identified, so probabilistic and active-exploitation signals are currently unavailable; this means the assessment rests on the vector and vendor description rather than observed exploitation. The mitigating real-world factor is exposure: the HMC is a management-plane device that should sit on a restricted administrative network, so the practical attack surface depends heavily on whether the appliance is reachable by untrusted hosts. There is no signal conflict - description (unauthenticated, elevated command execution) and CVSS (PR:N, network vector, high impact) agree.

An attacker with network reachability to an HMC appliance sends a crafted request to an input field that is passed to an OS command without proper validation, injecting shell metacharacters. Because no authentication is required (PR:N) and complexity is low (AC:L), the injected commands run with elevated privileges, giving the attacker control of the management console and, by extension, the managed IBM Power partitions. No public proof-of-concept has been identified at time of analysis.