IBM Server Firmware FSP: authenticated admin gets code execution via the firmware update path

CVSS 6.8CVE-2026-18681Firmware, BMC & network fabriccurated

Impact

An account with administrator-level access to the Flexible Service Processor can, under specific conditions, execute arbitrary code with full confidentiality, integrity and availability impact. The FSP is the out-of-band controller for the machine, so code there outlives the host operating system and is invisible to host-side monitoring and to any tenant workload. For operators running Power-based accelerator nodes, this converts management-plane credential exposure into durable footholds on the hardware. Clean-up is a service-processor reflash with the node out of production.

Who can reach it

Adjacent-network access to the FSP (service/management network) with authenticated administrator-level privileges. Authentication is required.

What to do

Move to the firmware level IBM names in advisory node 7283899; affected levels are FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80 and FW950.00-FW950.H2, and the record does not state the fixed level - read it off the advisory. This is a service-processor firmware flash, so schedule it as a node-out-of-service window. Until then, keep the FSP off any routable network and limit administrator credentials.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-18681 https://www.ibm.com/support/pages/node/7283899

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.