IBM Power Firmware EUVD-2026-62629

Exploitation requires authenticated service-level access to the IBM BMC/FSP (Flexible Service Processor) - the CVSS vector AV:L/PR:H confirms this is a local or adjacent-network interface requiring high-privilege credentials. The attacker must possess a valid service-level account on the BMC/FSP, typically restricted to hardware service personnel, system administrators with explicit BMC access rights, or automated service tooling with stored credentials. What limits exploitation: the PR:H authentication barrier means no unauthenticated or standard OS-level user can directly trigger this flaw; AV:L means the BMC management network must be reachable, which is typically segment-isolated in well-configured environments; and the attack targets the specific mailbox interface communication channel, not a general OS or application surface. No non-default configuration is identified as a prerequisite - any IBM Power system on an affected firmware version with an accessible BMC/FSP service interface is at risk from a credentialed service-level actor. The primary limiting factors for defenders are: network segmentation of the BMC interface and control over service-level credential access.

The CVSS 8.2 score with S:C accurately reflects the severity of crossing from the BMC management layer into the host firmware runtime - a trust boundary violation with maximum C/I/A impact on the managed system. The PR:H metric represents a meaningful pre-exploitation barrier: random internet attackers cannot reach or authenticate to this interface. However, insider threat actors, compromised service accounts, supply chain attacks targeting BMC credentials, or threat actors who have already established a foothold in a management network represent realistic paths to exploiting this flaw. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not available in the provided intelligence. AV:L reflects that the BMC/FSP management interface is local or adjacent-network - not directly internet-exposed - which is a genuine limiting factor. Despite the authentication and access barriers, the post-exploitation impact is firmware-level persistence on IBM Power hardware, surviving OS reinstallation, making patching the only reliable remediation for any organization running affected Power infrastructure in critical roles.

An attacker who has obtained service-level credentials to the IBM FSP/BMC - through credential theft, insider access, or compromise of a management system with stored BMC credentials - authenticates to the service processor interface and sends a specially crafted mailbox message. The malformed message triggers a CWE-787 out-of-bounds write in the firmware message parser, corrupting adjacent memory and redirecting execution to attacker-controlled code running in the host firmware runtime. From this position, the attacker achieves complete, persistent control over the managed Power system at a layer below the operating system that survives OS reinstallation. No public proof-of-concept has been identified at time of analysis.