CVE-2026-16661 Overview
CVE-2026-16661 is a high-severity vulnerability in the IBM PowerVM Hypervisor service processor mailbox interface. The flaw affects firmware releases FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An authenticated attacker with service-level access to the Flexible Service Processor (FSP) can exploit the mailbox interface to execute arbitrary code in the host firmware runtime. Successful exploitation grants full control over the managed system, compromising confidentiality, integrity, and availability. IBM has categorized the underlying weakness as an integer overflow [CWE-190].
Critical Impact
An authenticated attacker with FSP service-level access can execute arbitrary code in host firmware runtime and take full control of the managed PowerVM system.
Affected Products
- IBM PowerVM Hypervisor FW1120.00
- IBM PowerVM Hypervisor FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80
- IBM PowerVM Hypervisor FW950.00 through FW950.H2
Discovery Timeline
- 2026-08-19 - CVE-2026-16661 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-16661
Vulnerability Analysis
The vulnerability resides in the service processor mailbox interface used by the FSP to communicate with the PowerVM Hypervisor. The mailbox interface handles structured messages between the FSP and hypervisor runtime. Improper handling of numeric fields in a mailbox request permits an integer overflow condition. Once triggered, the overflow corrupts subsequent memory operations within the firmware runtime, enabling arbitrary code execution at the hypervisor privilege boundary. Because the hypervisor manages logical partitions (LPARs) on the Power system, code execution at this layer breaks isolation across every partition on the managed system.
Root Cause
The root cause is an integer overflow [CWE-190] in the mailbox message processing path. Length or size fields supplied through the mailbox are used in arithmetic operations without adequate bounds validation. The resulting wrap or truncation produces undersized buffer calculations that firmware code later uses for copy or dispatch operations. This creates a memory corruption primitive callable from the FSP interface.
Attack Vector
Exploitation requires local, authenticated access at the FSP service level, which is why the CVSS vector specifies AV:L and PR:H. An attacker with valid service processor credentials submits a crafted mailbox request that triggers the integer overflow. The scope change (S:C) reflects that a compromise of the FSP-facing interface transitions the attacker into the hypervisor runtime, crossing a privilege boundary. Once the attacker executes code in host firmware, the managed system, all LPARs, and any workloads running on the Power hardware are subject to full compromise.
No public proof-of-concept code is available. Refer to the IBM Support Document for vendor technical details.
Detection Methods for CVE-2026-16661
Indicators of Compromise
- Unexpected FSP service-level authentications, particularly from accounts that do not routinely operate maintenance workflows.
- Anomalous mailbox message sequences or malformed length fields recorded in FSP diagnostic logs.
- Unplanned hypervisor restarts, LPAR instability, or firmware runtime errors following FSP administrative sessions.
Detection Strategies
- Correlate FSP authentication events with subsequent firmware or hypervisor error logs to identify suspicious activity windows.
- Compare running firmware levels against IBM's fixed-version list to identify exposed systems.
- Alert on any change to FSP service account membership, credential resets, or new service network connectivity.
Monitoring Recommendations
- Forward Hardware Management Console (HMC) and FSP audit logs to a central SIEM for retention and correlation.
- Monitor management network segments carrying FSP traffic for unauthorized hosts or scanners.
- Track firmware inventory continuously so that any drift from the patched baseline generates an alert.
How to Mitigate CVE-2026-16661
Immediate Actions Required
- Restrict FSP and HMC network access to a dedicated, isolated management VLAN reachable only from trusted administrator jump hosts.
- Rotate all FSP service-level credentials and remove unused service accounts.
- Apply the fixed firmware level published by IBM as soon as maintenance windows permit.
Patch Information
IBM has published fixed firmware levels that remediate CVE-2026-16661 across the FW950, FW1060, FW1110, and FW1120 release streams. Consult the IBM Support Document for the exact target firmware builds and update procedures for each Power system model.
Workarounds
- Enforce strict network segmentation so only authorized administrators can reach the FSP interface.
- Require multi-factor authentication and privileged access management for all FSP and HMC accounts.
- Audit and reduce the number of accounts holding service-level FSP privileges pending firmware remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
