CVE-2026-16930: IBM Power Systems Firmware RCE Vulnerability

CVE-2026-16930 Overview

CVE-2026-16930 is a missing authorization vulnerability [CWE-862] in IBM Power Systems Firmware. The flaw exists in the interface between the Baseboard Management Controller / Flexible Service Processor (BMC/FSP) and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host, taking control of the host and all hosted partitions. Affected releases include FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. The vulnerability affects confidentiality, integrity, and availability across the system.

Critical Impact
Attackers with BMC/FSP privileges can execute arbitrary code on the host and pivot across every hosted logical partition, compromising the entire Power Systems platform.

Affected Products

IBM Power Systems Firmware FW1120.00
IBM Power Systems Firmware FW1110.00 through FW1110.30
IBM Power Systems Firmware FW1060.00 through FW1060.80

Discovery Timeline

2026-08-19 - CVE-2026-16930 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-16930

Vulnerability Analysis

The vulnerability resides in the trust boundary between the BMC/FSP and the host processor complex on IBM Power Systems. The BMC/FSP is intended to provide out-of-band management, hardware initialization, and service functions. The host system implicitly trusts commands and data exchanged with this service processor. Because the interface lacks proper authorization enforcement, a privileged BMC/FSP account can issue operations that result in arbitrary code execution on the host. That execution path bypasses hypervisor and partition isolation, giving the attacker control over every logical partition running on the system.

Root Cause

The root cause is missing authorization [CWE-862] on the BMC/FSP-to-host interface. Operations that should be restricted or validated against the requester's role are accepted from any process running with service or root privileges on the service processor. There is no additional integrity check to prevent the service processor from injecting host-executable payloads.

Attack Vector

Exploitation requires local access with high privileges on the BMC/FSP, either through a service account or root. An attacker who has already compromised the management plane, for example through weak BMC credentials, exposed management networks, or supply chain access, can escalate from the BMC/FSP into the host and its partitions. The scope changes from the management processor to the host, which explains why a local, high-privilege prerequisite still yields platform-wide compromise. See the IBM Support Page for vendor technical details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is low, consistent with the local, high-privilege prerequisite.

Detection Methods for CVE-2026-16930

Indicators of Compromise

Unexpected firmware update activity, configuration changes, or new service accounts on the BMC/FSP.
Anomalous processes, kernel modules, or hypervisor-level activity on the host that correlate with BMC/FSP command sessions.
Authentication events showing service or root logins to the BMC/FSP from unusual source IPs or outside maintenance windows.

Detection Strategies

Centralize BMC/FSP audit logs and correlate them with host and hypervisor telemetry to spot service-processor-initiated actions that affect host state.
Alert on privileged BMC/FSP account use, especially any command flow that precedes unexplained partition reboots, firmware writes, or host code changes.
Baseline expected BMC/FSP behavior during patch windows and treat deviations, such as off-hours firmware operations, as high-priority events.

Monitoring Recommendations

Restrict BMC/FSP management interfaces to a dedicated, monitored out-of-band network and log every authentication attempt.
Continuously monitor for unauthorized changes to firmware versions on FW1060, FW1110, and FW1120 release trains.
Forward BMC/FSP, hypervisor, and partition logs into a centralized analytics platform for cross-layer correlation.

How to Mitigate CVE-2026-16930

Immediate Actions Required

Apply the IBM firmware fixes referenced on the IBM Support Page to all affected FW1060, FW1110, and FW1120 systems.
Inventory every Power Systems server and confirm the running firmware level against the affected ranges.
Rotate BMC/FSP service and root credentials and remove any unused administrative accounts.

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-16930. Administrators should upgrade to the fixed firmware level specified by IBM for their platform generation. Firmware updates should be applied through supported IBM service procedures to preserve partition state and avoid downgrade windows.

Workarounds

Isolate BMC/FSP interfaces on a physically or logically separated management network, blocking access from user and production VLANs.
Enforce strong, unique credentials and multi-factor authentication for all BMC/FSP administrative accounts.
Limit service account and root access on the BMC/FSP to a minimal set of named administrators and audit every session.

bash

# Configuration example: restrict BMC/FSP management access
# Example ACL concept - adapt to your firewall or switch platform
# Allow only the jump host subnet to reach the BMC management VLAN
access-list BMC_MGMT permit tcp 10.10.50.0/24 host <bmc_ip> eq 443
access-list BMC_MGMT permit tcp 10.10.50.0/24 host <bmc_ip> eq 22
access-list BMC_MGMT deny   ip any host <bmc_ip>