IBM Power Systems Firmware: crafted configuration data from the BMC/FSP compromises the host boot stage

CVSS 8.2CVE-2026-17093Firmware, BMC & network fabriccurated

Impact

Host firmware mishandles configuration data supplied through the service processor, so an attacker with service-level BMC/FSP access can compromise the host firmware boot stage and, with it, everything loaded afterwards — hypervisor, partitions and workloads. Because the compromise lands at boot, it survives reinstalling partitions and is not something a host-side agent can detect. Affected levels reach back through FW950 and the OP940 Power9 and Power HMC streams. Recovery for a system you believe was hit is a firmware rebuild, not a redeploy.

Who can reach it

An attacker with authenticated service-level access to the BMC/FSP. That means management-network reach and valid service credentials; no interaction from a host user is needed.

What to do

Apply the fixed IBM firmware for the affected FW1120, FW1110, FW1060, FW950 and OP940 levels per the advisory, as a firmware flash on the managed system (and on the HMC for the OP940 Power HMC stream). Because the flaw is in the boot path, a system suspected of prior compromise should be re-flashed rather than only updated. No mitigation short of updating is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-17093 https://www.ibm.com/support/pages/node/7283239

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.