CVE-2026-17494: IBM Power Systems Firmware RCE Flaw

CVE-2026-17494 is a remote code execution vulnerability in IBM Power Systems Firmware affecting FW1120.00 and FW1110.00-FW1110.30. Attackers with BMC service access can execute arbitrary code on the host system. This post covers technical details, affected versions, impact, and mitigation strategies.

CVE-2026-17494 Overview

CVE-2026-17494 affects IBM Power Systems Firmware versions FW1120.00 and FW1110.00 through FW1110.30. The vulnerability resides in the interface between the Baseboard Management Controller (BMC) and the host system. An attacker with service access to the BMC can send a specially crafted command that executes arbitrary code on the host system. Successful exploitation grants full control over the host and all hosted partitions, resulting in complete loss of confidentiality, integrity, and availability. The flaw is tracked under [CWE-121] Stack-based Buffer Overflow.

Critical Impact
Arbitrary code execution on Power Systems hosts via BMC command interface, compromising all hosted partitions.

Affected Products

IBM Power Systems Firmware FW1120.00
IBM Power Systems Firmware FW1110.00 through FW1110.30
Host partitions managed by affected firmware versions

Discovery Timeline

2026-08-19 - CVE-2026-17494 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17494

Vulnerability Analysis

The vulnerability exists in the communication interface between the BMC and the host system on IBM Power Systems servers. The BMC is a dedicated microcontroller that provides out-of-band management functionality, including hardware monitoring and remote administration. Because the BMC operates below the operating system layer, code execution obtained through this interface bypasses host-level security controls entirely.

An attacker who holds service-level access to the BMC can transmit a crafted command across the host interface. The host firmware processes this command without adequate bounds validation, triggering a stack-based buffer overflow classified as [CWE-121]. The overflow overwrites the call stack and redirects execution flow to attacker-controlled instructions.

Root Cause

The root cause is improper validation of command payloads received from the BMC by the host-side firmware handler. Input length and structure are not verified before the data is copied onto a fixed-size stack buffer, enabling stack corruption.

Attack Vector

Exploitation requires local, authenticated access with high privileges at the BMC service interface. No user interaction is required. Because the scope changes from the BMC context to the host system and its partitions, a single compromised BMC can propagate control to every workload running on the physical server. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17494

Indicators of Compromise

Unexpected service-account authentication events against the BMC management interface
Anomalous IPMI or Redfish command sequences directed at the host interface
Unexplained partition restarts, hypervisor faults, or firmware integrity check failures
BMC configuration changes outside authorized maintenance windows

Detection Strategies

Correlate BMC access logs with change management records to identify unauthorized service sessions
Monitor host firmware event logs for anomalous command payloads or handler exceptions
Baseline expected BMC-to-host command patterns and alert on deviations

Monitoring Recommendations

Forward BMC and Hardware Management Console (HMC) audit logs to a centralized SIEM
Alert on privileged BMC logins from non-management network segments
Track firmware version inventory to identify systems still running FW1120.00 or FW1110.00–FW1110.30

How to Mitigate CVE-2026-17494

Immediate Actions Required

Inventory all IBM Power Systems servers and identify hosts running affected firmware levels
Restrict BMC service network access to a dedicated, isolated management VLAN
Rotate BMC service credentials and enforce multi-factor authentication where supported
Apply the firmware update published by IBM as soon as maintenance windows permit

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should upgrade to the fixed firmware level referenced in the advisory for both the FW1120 and FW1110 release streams.

Workarounds

Limit BMC service account membership to a minimal set of trusted administrators
Segment the BMC management network from production and user networks using firewalls or ACLs
Disable unused BMC management protocols and interfaces to reduce the attack surface

bash

# Example: restrict BMC management interface to a dedicated subnet
# (adapt to your network appliance syntax)
access-list BMC_MGMT permit ip 10.10.50.0/24 host <bmc_ip>
access-list BMC_MGMT deny   ip any host <bmc_ip>