IBM Power Firmware EUVD-2026-97870

Requires authenticated service-level access to the Flexible Service Processor (FSP) on IBM Power Systems firmware FW1060.00 through FW1060.81, from which the attacker sends a specially crafted message via the service processor mailbox interface to overflow host firmware runtime attribute storage. Limiting factors: this is a local/management-plane vector (AV:L) requiring high privileges (PR:H) - valid FSP service credentials or presence on the hardware management network - not remote or unauthenticated access; no user interaction is needed, and only the listed firmware levels are in scope. Defenders can materially reduce risk by isolating and restricting the FSP/management network and limiting service-level accounts.

This is a genuine high-severity issue but NOT a mass-exploitation priority, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) is dominated by the scope change and full CIA impact - code execution in host firmware runtime that compromises the entire managed system - but is held down from critical by the local attack vector (AV:L) and the requirement for high privileges (PR:H), namely authenticated service-level access to the FSP. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis. The combination of a privileged local prerequisite with no evidence of exploitation means this is a targeted-risk, defense-in-depth concern (an insider or an attacker who has already breached the service processor management plane) rather than an internet-facing, widely-scanned threat. Priority should be high for operators of the affected IBM Power firmware because of the severe impact and firmware-level persistence potential, but the PR:H gate substantially limits who can reach it. No signals are contradictory; the main gap is the complete absence of exploitation-probability data (EPSS/KEV/POC all unspecified in the input).

An attacker who already holds authenticated service-level credentials to the Flexible Service Processor (FSP) - for example a malicious insider or an adversary who has pivoted into the hardware management network - sends a specially crafted mailbox message through the service processor mailbox interface. The message overflows host firmware runtime attribute storage (a stack-based buffer overflow, CWE-121), letting the attacker run arbitrary code in the host firmware runtime and take full control of the managed system's memory and hardware. No public exploit code is identified at time of analysis, and exploitation requires local access to the FSP management interface rather than a remote network path.