CVE-2026-17063 Overview
CVE-2026-17063 is an authorization flaw in IBM Power Systems Firmware affecting the interface between the Baseboard Management Controller/Flexible Service Processor (BMC/FSP) and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state. Successful exploitation affects the managed system and all hosted partitions, resulting in confidentiality and availability impact. The weakness is categorized under [CWE-863] Incorrect Authorization.
Critical Impact
Attackers holding BMC/FSP service or root credentials can manipulate host processor state, disrupt the managed system, and impact every partition hosted on the affected IBM Power server.
Affected Products
- IBM Power Systems Firmware FW1120.00
- IBM Power Systems Firmware FW1110.00 through FW1110.30
- IBM Power Systems Firmware FW1060.00 through FW1060.80
Discovery Timeline
- 2026-08-19 - CVE-2026-17063 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-17063
Vulnerability Analysis
The vulnerability resides in the trust boundary between the BMC/FSP management processor and the host CPU on IBM Power Systems servers. The BMC/FSP is a privileged service processor responsible for platform initialization, monitoring, and management operations. The interface exposed to service-level users on the BMC/FSP does not enforce sufficient authorization checks before allowing operations that reach the host processor.
An attacker who has already obtained service account or root access to the BMC/FSP can invoke interfaces that alter host processor state. This crosses a security boundary between the management plane and the hosted workload plane. Because a single BMC/FSP manages the entire physical server, the impact extends to every logical partition (LPAR) running on that system.
The scope change reflected in the vulnerability metadata indicates that the exploit crosses from the management component into the host and its guests. Confidentiality and availability are affected, while data integrity of the host is not directly modified through this path.
Root Cause
The root cause is incorrect authorization [CWE-863] in the BMC/FSP-to-host interface. Privileged operations that should be restricted to a narrower administrative context are reachable by any principal with service or root credentials on the service processor.
Attack Vector
Exploitation requires local access to the BMC/FSP with high privileges (service account or root). No user interaction is required. An attacker who has compromised BMC credentials, gained lateral access to the management network, or abused a supply-chain foothold on the service processor can trigger the flaw. See the IBM Support Document for firmware-level details.
No verified exploit code has been published for this issue.
Detection Methods for CVE-2026-17063
Indicators of Compromise
- Unexpected authentication events for service or root accounts on the BMC/FSP management interface.
- Anomalous host partition reboots, processor state resets, or LPAR availability disruptions that coincide with BMC/FSP session activity.
- Firmware command invocations from the BMC/FSP that touch host processor state outside normal maintenance windows.
Detection Strategies
- Forward BMC/FSP audit logs, ASMI access logs, and HMC event logs to a centralized log platform and alert on privileged logins from unexpected sources.
- Baseline normal BMC/FSP-to-host command patterns and flag deviations, particularly commands that alter processor state or partition configuration.
- Correlate management-plane authentication events with host-side stability events such as partition crashes or checkstops.
Monitoring Recommendations
- Restrict and monitor network reachability to BMC/FSP management interfaces; alert on any connection from outside a dedicated management VLAN.
- Track firmware version inventory for all IBM Power servers to identify systems still running affected FW1120, FW1110, or FW1060 builds.
- Review service account usage on the service processor on a recurring cadence and alert on new or dormant account activity.
How to Mitigate CVE-2026-17063
Immediate Actions Required
- Inventory all IBM Power Systems servers and identify firmware versions in the affected ranges: FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.
- Apply the fixed firmware level published by IBM as documented in the IBM Support Document.
- Rotate BMC/FSP service and root credentials on any system suspected of unauthorized management-plane access.
Patch Information
IBM has published remediation guidance and updated firmware in the IBM Support Document. Administrators should update to the firmware level identified as fixed for their platform generation (FW1120, FW1110, or FW1060) and validate the update through the Hardware Management Console (HMC) or Advanced System Management Interface (ASMI).
Workarounds
- Isolate BMC/FSP management interfaces on a dedicated, access-controlled management network with no direct exposure to production or user networks.
- Enforce least privilege on service processor accounts; remove unused accounts and restrict service and root credentials to a minimal set of authorized administrators.
- Enable multi-factor authentication where supported on the HMC and management jump hosts used to reach the BMC/FSP.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
