IBM Power Systems Firmware: VMI connection-resource exhaustion denies virtualization management

CVSS 4.5CVE-2026-16678Firmware, BMC & network fabriccurated

Impact

A remote authenticated attacker on the adjacent network can exhaust connection resources in the Virtualization Management Interface, denying service on the management path of the server platform. On an accelerated Power node this is the interface used to create, migrate and monitor partitions, so losing it means losing the ability to reconfigure or recover tenants on that machine even while workloads keep running. The record describes availability impact only - no disclosure or modification - but it does require high privilege, so the realistic threat is a credentialed operator account or a compromised management host, not an arbitrary tenant.

Who can reach it

Network-adjacent access to the Power Systems management interface with high-privilege credentials (CVSS AV:A/PR:H). In practice: someone already on the management VLAN holding VMI credentials. Tenant workloads on the GPU side have no path to this.

What to do

Apply the fixed Power Systems firmware level per IBM support note 7287270; affected levels are FW1110.00-FW1110.31, FW1120.00-FW1120.01 and FW1060.00-FW1060.81. Platform firmware updates on Power are a scheduled maintenance item - some levels are concurrent, others require a platform IPL, so check the update's disruptive/concurrent designation for your level before booking the window. Until then, keep the management interface on an isolated VLAN and restrict which hosts can open VMI connections.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16678 https://www.ibm.com/support/pages/node/7287270

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.