IBM Power Systems firmware FW1060: unhandled exception crashes the service processor remotely

CVSS 6.5CVE-2026-17426Firmware, BMC & network fabriccurated

Impact

An unhandled exception in the FW1060 service processor firmware lets an unauthenticated attacker on the management segment cause a denial of service. Narrower in scope than the other IBM firmware issues in this batch - only the FW1060.00 through FW1060.81 levels are listed, with no OP9xx or HMC exposure - and it carries its own IBM support document and fixed levels. Impact is availability of out-of-band management only: the operator loses remote console, power control and sensor data on the affected machines while hosts continue to run.

Who can reach it

Unauthenticated, adjacent-network (CVSS AV:A): an attacker already on the management VLAN serving the Power service processors. No credentials required, and not reachable from a tenant workload that cannot route there.

What to do

Apply the fixed FW1060 level listed in IBM support document 7291689. Flashing is per machine and IBM states per level whether it installs concurrently or needs the system powered down; this record does not say, so confirm before booking the window. Keeping service processors off any routable or tenant-visible network removes the attack path in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-17426 https://www.ibm.com/support/pages/node/7291689

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.