CVE-2026-17093: IBM Power Systems Firmware Escalation Flaw

CVE-2026-17093 Overview

CVE-2026-17093 affects IBM Power Systems host firmware across multiple release trains, including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC). The flaw resides in the host firmware configuration parsing logic. An attacker with service-level access to the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) can supply crafted configuration data that compromises the firmware boot stage. Successful exploitation subverts every component loaded after the affected boot stage, impacting confidentiality, integrity, and availability of the managed system.

Critical Impact
A service-level actor on the BMC/FSP can compromise host firmware boot and gain persistent control over the managed Power system.

Affected Products

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30
IBM Power Systems Firmware FW1060.00 through FW1060.80, and FW950.00 through FW950.H2
IBM Power9 OP940.00 through OP940.a1, and Power HMC OP940.00 through OP940.81

Discovery Timeline

2026-08-19 - CVE-2026-17093 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17093

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] triggered during host firmware configuration parsing. Host firmware on IBM Power Systems reads configuration data supplied through the service processor. When the parser processes attacker-controlled configuration fields, insufficient bounds checks allow data to exceed a fixed-size stack buffer. The overflow corrupts adjacent stack memory, including saved return addresses and control structures used by the boot flow. Because the corruption occurs before the operating system loads, the compromise cascades into every subsequent boot stage. Attackers can subvert firmware integrity checks, install persistent implants, or destabilize the platform to cause denial of service on the managed system.

Root Cause

The root cause is unsafe handling of variable-length configuration fields inside the host firmware parser. The parser copies input into a stack buffer without validating that the input length fits the destination. This classic [CWE-121] pattern lets crafted configuration data overwrite the return address and pivot execution.

Attack Vector

Exploitation requires local, high-privilege access to the BMC or FSP service interface. The attacker cannot reach this vector across a public network without first compromising service-plane credentials or the management network. Once positioned, the attacker submits crafted configuration data that the host firmware ingests at boot. The scope change reflects that a compromise of the service processor path pivots into the host firmware trust boundary. See the IBM Support Page for vendor-supplied technical detail.

Detection Methods for CVE-2026-17093

Indicators of Compromise

Unexpected changes to host firmware configuration blobs pushed from the BMC/FSP outside of scheduled maintenance windows.
Host firmware boot logs showing parser errors, unexpected resets, or integrity verification anomalies during initialization.
New or unrecognized service-level accounts on the BMC/FSP, or logins from atypical management-network sources.

Detection Strategies

Collect and centralize BMC/FSP audit logs, correlating configuration writes with the identities that performed them.
Baseline current running firmware versions across the fleet and alert on drift from vendor-approved builds listed in the IBM advisory.
Monitor host firmware boot telemetry for repeated failures, unexpected recoveries, or fallback boot activations that may indicate exploitation attempts.

Monitoring Recommendations

Forward management-plane authentication events to a centralized SIEM and flag privileged BMC/FSP sessions.
Alert on any modification of firmware configuration parameters outside of change-controlled workflows.
Track the segmentation posture of the management network and detect new routes or hosts reaching BMC/FSP interfaces.

How to Mitigate CVE-2026-17093

Immediate Actions Required

Apply the IBM host firmware updates referenced in the IBM Support Page to all affected Power Systems.
Restrict BMC/FSP service accounts to the minimum required set and rotate credentials that may have been shared with third parties or contractors.
Isolate BMC/FSP management interfaces on a dedicated management VLAN with no direct exposure to user or internet-facing networks.

Patch Information

IBM has published fixed firmware levels for the impacted Power Systems trains. Administrators should consult the IBM Support Page for the exact remediated build numbers corresponding to FW1120, FW1110, FW1060, FW950, and OP940, then schedule updates through the Hardware Management Console (HMC).

Workarounds

Enforce strict access control lists on the management network so only authorized administration hosts can reach the BMC/FSP.
Require multi-factor authentication and change-controlled workflows for any service-level firmware configuration changes.
Audit existing service accounts and remove stale credentials before patch deployment to reduce the exploitable population.

bash

# Example: restrict BMC management access using a host firewall on the jump host
iptables -A OUTPUT -p tcp -d <BMC_SUBNET> --dport 443 -m owner --uid-owner fw-admin -j ACCEPT
iptables -A OUTPUT -p tcp -d <BMC_SUBNET> --dport 443 -j DROP