IBM Power Systems firmware: boot image validation flaw accepts a crafted code update image and runs it on the host

CVSS 8.2CVE-2026-96263Firmware, BMC & network fabriccurated

Impact

The host firmware boot process does not properly validate code update images, so an attacker with service access to the service processor can supply a malicious update image and execute arbitrary code on the host system. This is a signed-boot bypass in practice: the code the operator believes is verified firmware is attacker-supplied, it survives reinstalling the OS, and it sits beneath the hypervisor and every partition on the node. For a fleet, the worst case is a node that stays compromised through reimaging and cannot be trusted again without a known-good reflash. This id spans the widest firmware range of the batch - FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81.

Who can reach it

Local to the service processor with high privilege: an attacker needs service access to the FSP to stage the crafted code update image. No host OS or partition access needed.

What to do

Apply the fixed firmware level from IBM support document 7290129, which covers the FW1120, FW1110 and FW1060 streams. A firmware update is the fix and the update path itself is what is broken, so flash from a trusted source with the managed system out of service, and verify the resulting level afterwards. Keep FSP access restricted to the management VLAN and to accounts you can account for.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-96263 https://www.ibm.com/support/pages/node/7290129

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.