IBM Power Firmware EUVD-2026-97867

Requires authenticated service-level access to the Flexible Service Processor (FSP) and the ability to send messages over the service processor mailbox interface - i.e. the attacker must already hold privileged service-processor credentials (PR:H) with local/management-plane reach to the FSP, not network reach to the managed OS. Exploitation is limited to IBM Power Systems Firmware levels FW1060.00 through FW1060.81. No end-user interaction is needed (UI:N), but the HIGH-privilege prerequisite is the dominant limiting factor, confining realistic abuse to malicious insiders or attackers who have already compromised service-processor administration.

This is a genuine high-severity firmware flaw but one gated behind significant access requirements, so it is a priority for IBM Power operators rather than a broad internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) tells a consistent story: exploitation is local to the service processor, low-complexity, requires no user interaction, but demands HIGH privileges - specifically authenticated service-level access to the FSP - and crosses a scope boundary to fully compromise the managed host (confidentiality, integrity and availability all HIGH). The elevated 8.2 is driven mainly by the scope change (S:C) and triple-HIGH impact, not by ease of access. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable near-term exploitation; the PR:H requirement makes opportunistic mass exploitation unlikely and points toward an insider or post-compromise escalation scenario. Signals are internally consistent - no conflict between the vector and the description, both indicating privileged local service-processor access - so the main caveat is simply the absence of exploitation-probability data (no EPSS/KEV/POC) rather than any contradiction.

An attacker who has already obtained authenticated service-level credentials on the Flexible Service Processor (FSP) - for example a malicious or compromised administrator - crafts a malformed mailbox message and sends it over the service processor mailbox interface. Because the handler mishandles memory bounds (CWE-119), the message reads or overwrites arbitrary Hostboot memory, letting the attacker subvert the firmware boot stack and the hypervisor loaded from it. No public exploit identified at time of analysis, so this would require original development against the firmware.