Power Systems Firmware EUVD-2026-62687

The attacker must be present on the management network segment hosting the ASMI interface (AV:A confirmed by CVSS vector) - this is the primary limiting factor, restricting the realistic threat population to insiders, actors who have achieved lateral movement to a management-adjacent host, or environments where BMC/OOBM networks are insufficiently segmented from corporate or production networks. No authentication against the ASMI web interface is required (PR:N confirmed by CVSS vector). No special non-default configuration is needed - the ASMI interface is a standard component present across all affected IBM Power Systems firmware versions. Exploitation is bounded to the ASMI management layer; hosted LPARs and workloads are explicitly noted by IBM as unaffected. The confidentiality and integrity impacts (C:L/I:L) are limited to possible OOB memory disclosure and memory corruption within the ASMI process, not workload data.

The CVSS 7.6 score is driven primarily by the High availability impact, the absence of authentication requirements (PR:N), and low attack complexity, moderated to an adjacent-network vector (AV:A) that meaningfully constrains who can realistically exploit this. The management network restriction is the single most important limiting factor: in well-architected environments with a dedicated, isolated BMC/OOBM VLAN, the practical attacker pool is limited to insiders and lateral-movement actors who have already established a foothold on a privileged segment. However, even a mid-sized municipal IT team in inowroclaw running IBM Power hardware for core infrastructure should treat this as urgent if their ASMI management plane shares network segments with broader corporate systems, since losing ASMI access during an incident can critically impair recovery operations. No CISA KEV listing and no public POC reduce urgency for organizations with proper segmentation, but the SSVC signal for network-adjacent insider or compromised-host scenarios remains elevated. EPSS data was not provided; given the adjacent-network constraint, broad internet-scale exploitation probability is expected to be low, but targeted exploitation by a motivated actor with internal access is credible with minimal skill.

An attacker who has gained adjacency to the IBM Power Systems management network - via a compromised jump host, misconfigured VLAN, or insider access - sends a sequence of crafted HTTP requests to the ASMI web interface that trigger an out-of-bounds read in the web server process. Each malformed request causes ASMI to crash and auto-restart; by sustaining this at sufficient frequency, the attacker maintains a persistent denial of management access, preventing administrators from performing firmware operations, partition management, or hardware-level incident response. No public exploit code has been identified at time of analysis.