CVE-2026-18857: IBM Power System S1122 Information Disclosure

CVE-2026-18857 Overview

CVE-2026-18857 affects IBM OpenBMC firmware on multiple IBM Power Systems. The vulnerability resides in the Baseboard Management Controller (BMC) firmware management interface. A host system with elevated local privileges can trigger a condition that crashes the BMC firmware management service or exposes a limited amount of BMC internal memory. The flaw is classified as an out-of-bounds read [CWE-125] and impacts the confidentiality and availability of the managed system.

Affected firmware versions include FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81.

Critical Impact
A privileged host process can crash the BMC firmware management service or read limited regions of BMC internal memory, undermining out-of-band management and potentially leaking sensitive runtime data.

Affected Products

IBM Power System S1122 (9824-22A), S1124 (9824-42A), S1122S (9824-22B), S1114 (9824-41B) running OpenBMC FW1120.00 through FW1120.01
IBM Power System L1122 (9856-22H), L1124 (9856-42H), E1150 (9043-MRU), S1112 (9242-21B/21T) running OpenBMC FW1110.00 through FW1110.31
IBM Power System S1022 (9105-22A), S1024 (9105-42A), S1022S (9105-22B), S1014 (9105-41B), L1022 (9786-22H), L1024 (9786-42H), E1050 (9043-MRX), S1012 (9028-21B) running OpenBMC FW1060.00 through FW1060.81

Discovery Timeline

2026-09-24 - CVE-2026-18857 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-18857

Vulnerability Analysis

The vulnerability resides in the BMC firmware management interface exposed by IBM OpenBMC. OpenBMC runs on the Baseboard Management Controller, a dedicated service processor that provides out-of-band management for IBM Power Systems. When the managed host interacts with the firmware management service through the in-band interface, a request handler reads past the bounds of an allocated buffer. The result is either a service crash or disclosure of adjacent memory contents back to the host.

The attack surface is limited to actors operating from the host side with high privileges. There is no network path and no user interaction is required. Confidentiality impact is limited to small regions of BMC memory, and availability impact is scoped to the firmware management service rather than the entire BMC.

Root Cause

The root cause is an out-of-bounds read condition [CWE-125] in the BMC firmware management service. The handler does not sufficiently validate the length or offset parameters supplied by the host before performing a read operation on an internal buffer. Reads that extend beyond the allocated region either return uninitialized memory to the caller or trigger a fault in the service process.

Attack Vector

Exploitation requires local access to the managed host system with elevated privileges. An attacker with such access issues a crafted request through the host-to-BMC communication channel exposed by the firmware management service. The malformed request causes the BMC service to perform an out-of-bounds read. The attacker can repeat the operation to harvest small amounts of BMC memory or to deny availability of the firmware management function. No proof-of-concept exploit is publicly available at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

For host-to-BMC protocol details and the exact affected service, consult the IBM Security Bulletin.

Detection Methods for CVE-2026-18857

Indicators of Compromise

Unexpected restarts, hangs, or crash logs for the BMC firmware management service in OpenBMC journal output
Elevated rates of malformed or oversized requests on the host-to-BMC in-band interface (IPMI, PLDM, or MCTP transports)
Loss of availability of firmware management functions such as firmware inventory, update, or activation queries

Detection Strategies

Forward OpenBMC systemd journal and phosphor service logs to a central log platform and alert on repeated restarts of firmware management units
Baseline host-to-BMC request volumes and alert on anomalies originating from privileged host processes
Correlate BMC service faults with concurrent high-privilege activity on the managed host operating system

Monitoring Recommendations

Monitor BMC firmware versions across the fleet and flag any system still running FW1120.00–FW1120.01, FW1110.00–FW1110.31, or FW1060.00–FW1060.81
Audit which host accounts and services hold privileges capable of issuing firmware management requests to the BMC
Track IBM Power firmware advisories and apply updates through a managed patch cadence

How to Mitigate CVE-2026-18857

Immediate Actions Required

Inventory all IBM Power Systems and identify units running affected OpenBMC firmware levels
Restrict host-side privileges that can reach the BMC firmware management interface to a minimal set of administrators and automation accounts
Schedule firmware updates per the remediation guidance in the IBM Security Bulletin

Patch Information

IBM has published remediation guidance in the IBM Security Bulletin for CVE-2026-18857. Apply the fixed OpenBMC firmware level listed by IBM for each affected Power System model. Firmware updates for the BMC are delivered through the standard IBM firmware update process and typically require a BMC restart.

Workarounds

Limit which host operating system accounts and workloads can issue requests to the BMC firmware management service until patches are applied
Restrict physical and logical access to the managed host, since exploitation requires high-privilege local access on the host
Monitor BMC service health and alert operations teams on firmware management service crashes so recovery actions can be initiated quickly

bash

# Example: list current firmware level on an IBM Power system (AIX)
lsmcode -A

# Example: query BMC firmware inventory via Redfish (replace <bmc-host>)
curl -k -u <user>:<pass> https://<bmc-host>/redfish/v1/UpdateService/FirmwareInventory