EUVD-2026-97872
GHSA-ff7h-h85h-qx3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain privileged access on adjacent management network
-
ExploitOpen repeated connections to Power firmware
-
ExecutionExhaust connection resource pool
-
ImpactFirmware stops servicing legitimate requests (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
|
| Exploitation Conditions | Exploitation requires the attacker to already possess high privileges (PR:H - administrative/authenticated access to the firmware management interface) and network adjacency (AV:A - same local/management segment as the Power Systems service processor, not routable internet access). The affected product must be running one of the vulnerable firmware levels: FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, or FW1060.00 through FW1060.81. No user interaction is needed (UI:N). The key limiting factors are the dual requirements of privileged access and adjacent-network positioning, which together confine realistic exploitation to insiders or attackers who have already established a foothold on the management network; impact is limited to availability with no data exposure. |
| Impact | This is a genuinely low-to-moderate priority issue despite being a confirmed availability flaw. The CVSS 3.1 base score of 4.5 (MEDIUM) is consistent with the provided vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H: the attack is limited to an adjacent network (AV:A, not internet-wide), requires high privileges (PR:H), and impacts only availability (A:H) with no confidentiality or integrity loss. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code was referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent - a high-privilege, adjacent-network DoS against enterprise firmware is realistically a targeted insider/lateral-movement concern rather than a mass-exploitation threat. The combination of PR:H and AV:A substantially limits real-world exposure; an attacker must already hold privileged access on an adjacent management segment, so this is not a drop-everything issue absent that threat model. |
| Exploit ScenarioDerived | An attacker who already holds privileged (administrative) access and sits on the same adjacent management network as an IBM Power Systems service processor repeatedly opens connections without proper teardown, exhausting the firmware's connection resource pool. Because of improper resource management (CWE-772), the firmware fails to reclaim these resources and becomes unable to service legitimate management connections, causing a denial of service. No public proof-of-concept was referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Connection-resource exhaustion in IBM Power Systems firmware levels FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 lets a highly privileged attacker on an adjacent network segment drive a denial of service by consuming connections the service processor never releases, until legitimate management traffic can no longer be serviced. The assessed vector (CVSS 4.5, AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) means exploitation requires pre-existing administrative access to the affected interface plus network adjacency to the management segment, which confines realistic risk to insiders or attackers who have already established a foothold on the management network; confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and there is no indication of active exploitation, making this a low-to-moderate priority availability issue rather than an urgent one.
RemediationAI
No vendor-released patch identified at time of analysis; the supplied reference is IBM's support page (https://www.ibm.com/support/pages/node/7287270), which should be treated as the authoritative source for corrected firmware builds and must be re-checked, since fixes for service-processor firmware are typically published as new build levels above the ranges above rather than as a downloadable patch for existing images. Until a corrected level is published, apply compensating controls aimed at the two preconditions this flaw depends on. First, restrict reachability of the service processor management interface: place it on a dedicated, tightly firewalled management VLAN with no route from general user or production networks, since exploitation requires adjacency (AV:A) - the trade-off is that firmware/management access then depends on jump hosts or console access, which can slow legitimate administration. Second, limit and monitor concurrent management sessions: apply per-source connection limits or session quotas on the management segment and alert on abnormal connection counts or sessions that never close, which directly targets the CWE-772 exhaustion pattern but requires management-segment telemetry that many environments lack. Third, enforce credential hygiene and least privilege on the firmware management accounts, because the flaw requires high privileges (PR:H); this reduces insider and post-compromise exposure but does not protect against an attacker who already holds admin credentials. Restarting the service processor will release leaked resources and restore availability, but it is disruptive, drops all other management sessions, and is only a temporary measure because the attacker can repeat the exhaustion. There is no indication of active exploitation, so these mitigations can be scheduled through normal change control rather than emergency response.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime): the firmware opens connection-oriented resources - sessions/handles associated with the Power Systems service processor management interface - and fails to release them once their useful lifetime ends, so repeated or persistent connections accumulate until the pool is depleted. Improper resource management of this class is a classic slow-burn availability bug: each individual request is legitimate and unremarkable, and the failure only manifests as cumulative exhaustion that degrades or blocks further management access. The attack surface is the adjacent management network (AV:A), not a routable internet-facing service, and the privileged requirement (PR:H) reflects that the attacker must already be able to reach and authenticate to the firmware management interface. The absence of a C/I impact component means the flaw is purely a resource-lifetime defect, not a memory-corruption or injection primitive. No CPE strings were supplied with this record, so the exact hardware/service-processor model mapping should be confirmed against IBM's advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Adjacent management-network reach (AV:A) and required privileged firmware access (PR:H) with availability-only impact; low complexity resource-exhaustion, no confidentiality or integrity effect.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB