IBM Power Systems firmware: unbounded computation lets an adjacent attacker exhaust the service processor

CVSS 6.5CVE-2026-16697Firmware, BMC & network fabriccurated

Impact

The service processor does not restrict excessive computational resource use, so an unauthenticated attacker on the management segment can drive it into a denial of service. This is a distinct mechanism from the other IBM firmware DoS issues in this batch - resource exhaustion rather than a crash on malformed input - and IBM published it under its own support document, so it may be fixed at a different level. Operational cost is the same: out-of-band management of the affected systems and the Power Hardware Management Console goes away while the hosts keep running, removing remote console and power control from the fleet exactly when an operator might need them.

Who can reach it

Unauthenticated, adjacent-network (CVSS AV:A): an attacker with a foothold on the management VLAN serving the service processors and the HMC. No credentials required.

What to do

Apply the fixed levels listed in IBM support document 7294277 for the affected FW1060 and OP940/OP910 streams and update the Power Hardware Management Console. Flashing is per machine and IBM states per level whether it installs concurrently or requires the system down - the record does not say, so confirm before booking a window. Restricting management-network reach limits the exposure without any firmware action.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16697 https://www.ibm.com/support/pages/node/7294277

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.