CVE-2026-16832: IBM Power Systems Firmware RCE Vulnerability

CVE-2026-16832 Overview

CVE-2026-16832 is a stack-based buffer overflow [CWE-121] in the Flexible Service Processor (FSP) management network protocol used by IBM Power Systems Firmware. An authenticated Hardware Management Console (HMC) administrator on an adjacent network can execute arbitrary code on the service processor. Successful exploitation grants full control over the managed system, breaking confidentiality, integrity, and availability guarantees.

Affected firmware streams include FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.

Critical Impact
Arbitrary code execution on the service processor gives an attacker complete control of the managed IBM Power system, including hosted logical partitions.

Affected Products

IBM Power Systems Firmware FW1120.00
IBM Power Systems Firmware FW1110.00 through FW1110.30
IBM Power Systems Firmware FW1060.00 through FW1060.80 and FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-16832 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-16832

Vulnerability Analysis

The vulnerability lives in IBM Power Systems Firmware, specifically in the FSP management network protocol handler. The FSP is the service processor that provides out-of-band management for Power systems and is normally reachable from the HMC over a dedicated management network.

A request handled by the FSP protocol writes attacker-controlled data past the bounds of a stack buffer. This is a classic stack-based buffer overflow [CWE-121] that allows corruption of return addresses or adjacent stack state.

Because the code executes inside the service processor, successful exploitation subverts the trust boundary between the HMC administrator role and the firmware itself. The scope change reflected in the CVSS vector captures this crossing of a security authority: code runs on the FSP rather than in the HMC user context.

The attacker must already hold authenticated HMC administrator credentials and must reach the FSP over the adjacent management network. These preconditions raise the bar for exploitation but do not reduce the impact once achieved.

Root Cause

The root cause is missing or incorrect bounds validation on a length or size field consumed by the FSP management protocol parser. When the parser copies protocol payload into a fixed-size stack buffer, oversized input overwrites adjacent stack memory, including saved return addresses on the service processor.

Attack Vector

An attacker with authenticated HMC administrator access sends crafted FSP protocol traffic from the HMC-to-FSP management network. The malformed message triggers the overflow inside the firmware, redirects execution, and runs attacker-supplied code with service processor privileges. The service processor then controls power, boot, partition configuration, and hypervisor state on the managed Power system.

No verified public exploit code is available for this vulnerability. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-16832

Indicators of Compromise

Unexpected FSP reboots, firmware crash dumps, or service processor state transitions logged by the HMC
HMC administrator sessions originating from unusual source hosts or at unusual times, followed by FSP protocol traffic bursts
Unplanned changes to partition configuration, boot settings, or hypervisor firmware attested state

Detection Strategies

Compare running firmware levels on each managed system against the fixed IBM levels and flag any system still in the vulnerable ranges
Alert on HMC audit log events showing administrator logins that immediately precede FSP protocol errors or service processor restarts
Monitor the HMC-to-FSP management VLAN for malformed or oversized FSP protocol frames

Monitoring Recommendations

Forward HMC and FSP logs to a centralized SIEM and retain them long enough to support incident review
Baseline normal FSP management traffic volume and packet sizes, then alert on statistical deviations
Audit HMC administrator account inventory and enforce multi-factor authentication where supported

How to Mitigate CVE-2026-16832

Immediate Actions Required

Inventory all IBM Power systems and identify any running firmware in the vulnerable FW1120, FW1110, FW1060, or FW950 ranges
Restrict the HMC-to-FSP management network to a dedicated, isolated VLAN reachable only by authorized HMCs
Rotate HMC administrator credentials and review recent administrator activity for anomalies

Patch Information

IBM has published fixed firmware levels and remediation guidance on the IBM Support Page. Apply the vendor-supplied firmware update for each affected FW1120, FW1110, FW1060, and FW950 stream on all managed Power systems.

Workarounds

Reduce the number of accounts granted HMC administrator role and require just-in-time elevation where feasible
Enforce network segmentation so that only authorized HMC appliances can reach FSP management interfaces
Disable or remove unused HMC user accounts and audit remaining accounts for password strength and MFA coverage

bash

# Example: list managed systems and current firmware level from an HMC CLI session
lssyscfg -r sys -F name,type_model,serial_num,curr_power_on_side,activated_lic_bitmap
lslic -m <managed_system_name> -t sys