CVE-2026-18870: IBM Power System S1122 Information Disclosure

CVE-2026-18870 Overview

CVE-2026-18870 is an out-of-bounds read vulnerability in the IBM PowerVM Hypervisor firmware. The flaw affects firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3. An attacker on an adjacent network can read memory beyond the intended buffer boundary and disclose sensitive information processed by the hypervisor. The weakness is classified as [CWE-125] Out-of-Bounds Read. IBM published a support advisory assigning this issue a medium severity rating.

Critical Impact
A successful attack discloses limited confidential hypervisor memory contents to an attacker with adjacent network access, with no impact on integrity or availability.

Affected Products

IBM PowerVM Hypervisor firmware FW1120.00 through FW1120.01 on Power10 systems (E1080, E1050, S1012, S1014, S1022, S1024, S1022s, L1022, L1024, S1112, S1122, S1122s, S1124, S1114, L1122, L1124, E1150, E1180)
IBM PowerVM Hypervisor firmware FW1110.00 through FW1110.31 and FW1060.00 through FW1060.81 on supported Power10 Scale-Out and Enterprise systems
IBM PowerVM Hypervisor firmware FW950.00 through FW950.H3 on Power9 systems (S922, H922, S914, S924, H924, E950, E980)

Discovery Timeline

2026-09-24 - CVE-2026-18870 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-18870

Vulnerability Analysis

The PowerVM Hypervisor firmware mishandles bounds checking when reading from an internal buffer during processing of input received over an adjacent network interface. Because the hypervisor fails to validate the read offset against the buffer length, it returns memory contents outside the intended region. The disclosed bytes can include transient hypervisor data that was not intended for the requesting partition or caller.

Exploitation requires adjacent network access and no authentication or user interaction. The vulnerability only affects confidentiality; integrity and availability of the hypervisor are not impacted. Because PowerVM manages logical partitions (LPARs) across Power9 and Power10 systems, leaked memory can expose data belonging to co-resident workloads.

Root Cause

The defect is an out-of-bounds read [CWE-125] in the firmware code path that parses adjacent-network input. The firmware reads past the end of an allocated structure before applying length validation. This permits adjacent attackers to retrieve small amounts of residual memory per request.

Attack Vector

An attacker positioned on the same logical or physical adjacent network segment as the Power system crafts requests that trigger the vulnerable read path in the hypervisor. Repeated requests allow incremental extraction of memory contents. No credentials are required and no action by an administrator is needed on the target system.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability of exploitation is 0.185%. See the IBM Support advisory for vendor-provided technical context.

Detection Methods for CVE-2026-18870

Indicators of Compromise

No vendor-published indicators of compromise are available for CVE-2026-18870 at this time
Unusual volumes of adjacent-network requests directed at Hardware Management Console (HMC) or service processor interfaces of Power systems
Unexpected or repeated malformed packets targeting PowerVM management network segments

Detection Strategies

Audit the Flexible Service Processor (FSP) firmware level on each Power system and flag any version in the vulnerable ranges FW1120.00–FW1120.01, FW1110.00–FW1110.31, FW1060.00–FW1060.81, or FW950.00–FW950.H3
Enable logging on HMC and service network switches to capture source addresses and packet patterns reaching the hypervisor management interface
Correlate network telemetry with firmware inventory data to identify adjacent hosts that could reach vulnerable PowerVM instances

Monitoring Recommendations

Monitor the dedicated service and HMC VLANs for traffic originating from workloads or hosts that should not communicate with Power system management interfaces
Alert on connection attempts to PowerVM management services from LPARs or systems outside the approved administrator population
Track firmware update status across the Power estate and raise an alert when systems drift from the fixed firmware level

How to Mitigate CVE-2026-18870

Immediate Actions Required

Inventory all IBM Power9 and Power10 systems and record their current PowerVM Hypervisor firmware level
Apply the fixed firmware level identified in the IBM Support advisory for each affected machine type and model
Restrict adjacent-network reachability of the HMC, FSP, and PowerVM management interfaces to a dedicated administrative segment

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support node 7289135. Administrators should install the firmware updates that exceed the vulnerable ranges FW1120.01, FW1110.31, FW1060.81, and FW950.H3 for the corresponding system family. Firmware updates for PowerVM are delivered through standard IBM Fix Central channels and installed via the HMC.

Workarounds

Isolate PowerVM service processor and HMC interfaces on a dedicated, access-controlled management VLAN with no connectivity to general-purpose workloads
Enforce Layer 2 and Layer 3 access controls so only authorized administrator hosts can reach Power system management endpoints
Where firmware updates must be deferred, increase monitoring of management-plane traffic and review HMC audit logs frequently

bash

# Example: query current PowerVM firmware level from the HMC CLI
lssyscfg -r sys -F name,type_model,serial_num,curr_power_on_level

# Example: upgrade firmware on a managed system from a pre-staged repository
updlic -o a -t sys -r mountpoint -l latest -m <managed_system_name>