IBM Power Systems Firmware EUVD-2026-62686

Exploitation requires service-level access to the BMC (Baseboard Management Controller) of an affected IBM Power Systems server - specifically the ability to issue commands through the BMC-to-host firmware interface. This access corresponds to privileged out-of-band management credentials such as those used by IBM HMC service accounts, hardware maintenance personnel, or automated firmware management tooling. The CVSS PR:H metric confirms that high privileges are required; unauthenticated or standard OS-level attackers cannot reach the vulnerable interface. No non-default configuration is required - the vulnerable interface is present in default deployments of all affected firmware versions. No user interaction is required once the requisite service access is obtained. Exploitation is limited by: the requirement for high-privilege BMC service credentials (ruling out unprivileged or network-only attackers), the need for access to the BMC management network (which in well-architected environments is isolated from general networks), and the specificity of the affected firmware version range (FW1110.00-FW1110.30 and FW1120.00 only).

The CVSS 3.1 base score of 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H reflects a high-privilege prerequisite (service access to the BMC) combined with a scope change that extends total CIA triad impact across the host and all hosted partitions. The local attack vector (AV:L) is appropriate given that BMC service access typically requires privileged out-of-band management credentials or physical access to the management network, materially limiting opportunistic exploitation. No EPSS score was supplied in available data, preventing quantitative exploitation likelihood assessment; the CVE is also absent from the CISA KEV catalog at time of analysis, so no confirmed active exploitation signal exists. Despite the PR:H constraint - which reduces the SSVC automatable risk rating - the scope change and full CIA impact mean that even a mid-sized municipal IT team in gliwice running IBM Power infrastructure for core financial or ERP workloads should treat this as an urgent patching priority, since a single compromised service credential could cascade across every LPAR on the affected host. Insider threat scenarios and supply-chain service access (e.g., third-party hardware maintenance accounts) are the most plausible real-world exploitation paths given the privilege requirement.

An attacker who has obtained privileged service credentials to the BMC - through insider access, credential theft from an HMC administrative account, or compromise of a management workstation with stored BMC credentials - connects to the BMC management interface and issues a specially crafted command designed to overflow a stack buffer in the host-side interface handler. The overflow overwrites a return address or function pointer, redirecting execution to attacker-controlled code that runs at the host firmware privilege level. From this position the attacker achieves full administrative control over the host system and every logical partition it hosts, enabling persistent backdoor implantation, credential harvesting across all LPARs, and total data exfiltration.