Skip to main content

Power Systems Firmware EUVDEUVD-2026-62688

| CVE-2026-18848 HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-08-19 ibm GHSA-pghq-9pjf-cfhf
CSRF IBM Power Systems Firmware
8.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ibm) PRIMARY
HIGH
qualitative
NVD
8.3 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
vuln.today AI
8.3 HIGH

Attacker needs no credentials (CSRF abuses admin session); UI:R reflects mandatory admin interaction; FSP impact is high integrity and availability, limited confidentiality.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 19:37 vuln.today
CVE Published
Aug 19, 2026 - 18:44 nvd
HIGH 8.3

DescriptionNVD

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

AnalysisAI

Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify ASMI administrator at target org
Delivery
Craft webpage with hidden CSRF payload targeting FSP endpoints
Exploit
Lure admin via phishing while authenticated to ASMI
Execution
Admin browser silently submits forged administrative requests
Persist
FSP executes privileged actions on managed Power System
Impact
Confidentiality, integrity, or availability of managed hardware compromised
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that an IBM Power Systems ASMI administrator holds an active, authenticated session in the ASMI web interface at the time of the attack. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.3 High rating reflects a meaningful combination of factors: network reachability (AV:N), low attack complexity (AC:L), no attacker privileges required (PR:N), and high integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker researches IBM Power Systems administrators at a target organization and crafts a phishing email or watering-hole page containing hidden HTML or JavaScript that issues forged HTTP requests to the ASMI management interface. When a logged-in ASMI administrator visits the malicious page, their browser automatically submits the forged requests carrying valid session cookies, causing the FSP to execute administrative actions - such as modifying firmware settings, disabling hardware, or altering access controls - without any visible prompt to the administrator. …
Remediation Apply the firmware patch released by IBM per the advisory at https://www.ibm.com/support/pages/node/7283897. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all IBM Power Systems in your environment running affected firmware versions (FW950, FW1060, FW1110, FW1120) and assess which ASMI web interfaces are exposed to the network. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Power Systems Firmware

View all
CVE-2026-16687 CRITICAL
9.6 Aug 19

Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
CVE-2026-16835 CRITICAL
9.6 Aug 19

Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
CVE-2026-16832 HIGH
8.4 Aug 19

Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
CVE-2026-16933 HIGH
8.2 Aug 19

Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
CVE-2026-17494 HIGH
8.2 Aug 19

Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
CVE-2026-16930 HIGH
8.2 Aug 19

Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
CVE-2026-17429 HIGH
8.1 Aug 19

Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor

CVE-2026-17063 HIGH
7.9 Aug 19

IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
CVE-2026-16828 HIGH
7.6 Aug 19

Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
CVE-2026-17042 HIGH
7.3 Aug 19

Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
CVE-2026-16938 MEDIUM
6.9 Aug 19

IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

EUVD-2026-62688 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy