IBM Power Systems Firmware BMC/FSP Full Control (FW10601120)
CVE-2026-17429 Published on August 19, 2026
Power System Incorrect Authorization
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
Vulnerability Analysis
CVE-2026-17429 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-17429 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-17429
Want to know whenever a new CVE is published for IBM Power Systems Firmware? stack.watch will email you.
Affected Versions
IBM Power Systems Firmware:- Version FW1120.00 is affected.
- Version FW1110.00, <= FW1110.30 is affected.
- Version FW1060.00, <= FW1060.80 is affected.
- Version FW950.00, <= FW950.H2 is affected.
- Version OP940.00, <= OP940.a1 is affected.
- Version OP940.00, <= OP940.81 is affected.