CVE-2026-16687
critical · 9.6IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
9.6
CVSS
0.3%
EPSS (exploit prob.)
28th
EPSS percentile
2026-08-19
Published
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-121
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | power_system_e1180_(9080-heu)_firmware | >= fw1110.00, < fw1110.31 |
| ibm | power_system_e1180_(9080-heu)_firmware | fw1120.00 |
| ibm | power_system_e1180_(9080-heu) | all versions |
| ibm | power_system_e1080_(9080-hex)_firmware | >= fw1060.00, < fw1060.81 |
| ibm | power_system_e1080_(9080-hex) | all versions |
| ibm | power_system_s922_(9009-22g)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_s922_(9009-22g) | all versions |
| ibm | power_system_h922_(9223-22s)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_h922_(9223-22s) | all versions |
| ibm | power_system_s914_(9009-41g)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_s914_(9009-41g) | all versions |
| ibm | power_system_s924_(9009-42g)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_s924_(9009-42g) | all versions |
| ibm | power_system_h924_(9223-42s)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_h924_(9223-42s) | all versions |
| ibm | power_system_e950_(9040-mr9)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_e950_(9040-mr9) | all versions |
| ibm | power_system_e980_(9080-m9s)_firmware | >= fw950.00, < fw950.h3 |
| ibm | power_system_e980_(9080-m9s) | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-16687