Vulnerability-Lookup

CVE-2026-16707 (GCVE-0-2026-16707)

Vulnerability from cvelistv5 – Published: 2026-08-19 20:09 – Updated: 2026-08-21 03:57

Title

Power System Out-of-bounds Read

Summary

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 00:00 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

ibm mitre root

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7283235	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version	CPE status
IBM	PowerVM Hypervisor	Affected: FW1120.00 Affected: FW1110.00 , ≤ FW1110.30 (semver) Affected: FW1060.00 , ≤ FW1060.80 (semver) Affected: FW950.00 , ≤ FW950.H2 (semver) cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw950.00:::::::* cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T03:57:27.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"
          ],
          "product": "PowerVM Hypervisor",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "FW1120.00"
            },
            {
              "lessThanOrEqual": "FW1110.30",
              "status": "affected",
              "version": "FW1110.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "FW1060.80",
              "status": "affected",
              "version": "FW1060.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "FW950.H2",
              "status": "affected",
              "version": "FW950.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\u003c/p\u003e"
            }
          ],
          "value": "IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T20:09:07.749Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7283235"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers with the products below should install FW1110.31(1110_134), FW1120.01(1120_167), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1180 (9080-HEU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1110.31(1110_155), FW1120.01(1120_190), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1122 (9824-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1124 (9824-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1122s (9824-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1114 (9824-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1122 (9856-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1124 (9856-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1150 (9043-MRU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1120.01(1120_190), or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1112 (9242-21B, 9242-21T)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cbr/\u003eCustomers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1080 (9080-HEX)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install\u00a0 FW1060.81(1060_191), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1022 (9105-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1024 (9105-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1022s (9105-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1014 (9105-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1022 (9786-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1024 (9786-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1050 (9043-MRX)\u003c/li\u003e\u003cli\u003eIBM Power System S1012 (9028-21B)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\u003cbr/\u003ePower 9\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S922 (9009-22G)\u003c/li\u003e\u003cli\u003eIBM Power System H922 (9223-22S)\u003c/li\u003e\u003cli\u003eIBM Power System S914 (9009-41G)\u003c/li\u003e\u003cli\u003eIBM Power System S924 (9009-42G)\u003c/li\u003e\u003cli\u003eIBM Power System H924 (9223-42S)\u003c/li\u003e\u003cli\u003eIBM Power System E950 (9040-MR9)\u003c/li\u003e\u003cli\u003eIBM Power System E980 (9080-M9S)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eThe images mentioned above can be located at IBM Fix Central : \u003c/em\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003e\u003cem\u003ehttps://www.ibm.com/support/fixcentral/\u003c/em\u003e\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "Customers with the products below should install FW1110.31(1110_134), FW1120.01(1120_167), or newer to remediate this vulnerability.\nPower 11\n\n  *  IBM Power System E1180 (9080-HEU)\n\n\nCustomers with the products below should install FW1110.31(1110_155), FW1120.01(1120_190), or newer to remediate this vulnerability.\nPower 11\n\n  *  IBM Power System S1122 (9824-22A)\n  *  IBM Power System S1124 (9824-42A)\n  *  IBM Power System S1122s (9824-22B)\n  *  IBM Power System S1114 (9824-41B)\n  *  IBM Power System L1122 (9856-22H)\n  *  IBM Power System L1124 (9856-42H)\n  *  IBM Power System E1150 (9043-MRU)\n\n\nCustomers with the products below should install FW1120.01(1120_190), or newer to remediate this vulnerability.\n\n\n\nPower 11\n\n  *  IBM Power System S1112 (9242-21B, 9242-21T)\n\n\n\nCustomers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.\nPower 10\n\n  *  IBM Power System E1080 (9080-HEX)\n\n\nCustomers with the products below should install\u00a0 FW1060.81(1060_191), or newer to remediate this vulnerability.\nPower 10\n\n  *  IBM Power System S1022 (9105-22A)\n  *  IBM Power System S1024 (9105-42A)\n  *  IBM Power System S1022s (9105-22B)\n  *  IBM Power System S1014 (9105-41B)\n  *  IBM Power System L1022 (9786-22H)\n  *  IBM Power System L1024 (9786-42H)\n  *  IBM Power System E1050 (9043-MRX)\n  *  IBM Power System S1012 (9028-21B)\n\n\n\n\n\n\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\nPower 9\n\n  *  IBM Power System S922 (9009-22G)\n  *  IBM Power System H922 (9223-22S)\n  *  IBM Power System S914 (9009-41G)\n  *  IBM Power System S924 (9009-42G)\n  *  IBM Power System H924 (9223-42S)\n  *  IBM Power System E950 (9040-MR9)\n  *  IBM Power System E980 (9080-M9S)\n\n\n\n\n\n\nThe images mentioned above can be located at IBM Fix Central :  https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/"
        }
      ],
      "title": "Power System Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-16707",
    "datePublished": "2026-08-19T20:09:07.749Z",
    "dateReserved": "2026-07-23T01:58:36.625Z",
    "dateUpdated": "2026-08-21T03:57:27.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-16707",
      "date": "2026-08-26",
      "epss": "0.00132",
      "percentile": "0.02998"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-16707\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-08-19T20:17:02.140\",\"lastModified\":\"2026-08-25T19:34:20.303\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"PowerVM Hypervisor\",\"cpes\":[\"cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"FW1120.00\",\"status\":\"affected\"},{\"version\":\"FW1110.00\",\"lessThanOrEqual\":\"FW1110.30\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"FW1060.00\",\"lessThanOrEqual\":\"FW1060.80\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"FW950.00\",\"lessThanOrEqual\":\"FW950.H2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.5,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T00:00:00+00:00\",\"id\":\"CVE-2026-16707\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122_\\\\(9824-22a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"C016EFBA-A371-4264-A823-A7635D39F6D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122_\\\\(9824-22a\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8707806-84E4-442B-A29F-7BF44514F8DA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1122_\\\\(9824-22a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96C2DEDC-012D-4B9F-B9DF-344A49B67E46\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1124_\\\\(9824-42a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"6B512BF5-7D6B-45EA-97B8-F22B63A62270\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1124_\\\\(9824-42a\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25BCA648-5FF1-4B90-98ED-23E5BB217465\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1124_\\\\(9824-42a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F51514A-8E29-42D1-B874-838F8A0869D2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122s_\\\\(9824-22b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"BC8256E1-574D-4666-BE1B-45977348AC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122s_\\\\(9824-22b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2165EAA9-EDC9-4010-9D31-294F9414A9E6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1122s_\\\\(9824-22b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26E1E16B-8F95-46EC-BAA0-0A53F332292B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1114_\\\\(9824-41b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"3F8C1054-A539-468C-9A5F-E6E686C6CE8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1114_\\\\(9824-41b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"085F1C27-D806-4E4B-A44A-BB3C056CFCF7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1114_\\\\(9824-41b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8688E552-BE38-4EB9-8514-D7060C548C39\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1122_\\\\(9856-22h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"37868E6E-7759-4CCB-995E-BDB7F61F6818\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1122_\\\\(9856-22h\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50916B93-7340-4344-AF34-91836ABE508F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1122_\\\\(9856-22h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1124_\\\\(9856-42h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"9F0FE92C-3510-475A-8D02-ED17ADD87CD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1124_\\\\(9856-42h\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FECCD687-64E7-45B4-BCB7-AEF25164D049\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1124_\\\\(9856-42h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1150_\\\\(9043-mru\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"DC4CCBFC-3120-475D-BF75-025C04E41B91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1150_\\\\(9043-mru\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE428FBB-4DDC-4E05-A5C3-F37BE9395723\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1150_\\\\(9043-mru\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC9D9EFF-1E92-4894-9976-001227F78869\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1112_\\\\(9242-21b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6505E499-E766-451D-9996-1668BE53AAF8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1112_\\\\(9242-21b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3F5100A-FE2A-412C-9B57-B616B97B1142\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1112_\\\\(9242-21t\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"109DE27E-5F87-4BD0-8C48-F72A1C2AD55D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1112_\\\\(9242-21t\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA825307-2083-4264-8E8B-798661285261\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1080_\\\\(9080-hex\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"AA6D803F-DD5C-49A7-BE93-68981C124C69\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1080_\\\\(9080-hex\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF85251B-E02C-4293-98F0-D331BF51CAC4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1022_\\\\(9105-22a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"0BB54554-C9DC-4072-A205-EA9DD4E15688\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1022_\\\\(9105-22a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1024_\\\\(9105-42a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"FA4B835D-CEAB-422B-9F38-F63AF84396C3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1024_\\\\(9105-42a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E49EE658-B8AE-48F7-A765-92BA3A630AA0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1022s_\\\\(9105-22b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"51C2576F-E4DD-4002-9E41-CF89F92E2064\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1022s_\\\\(9105-22b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1014_\\\\(9105-41b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"41572D5A-C3A2-4294-9AF9-D4824675B4A3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1014_\\\\(9105-41b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECD54B80-5754-4C19-AE0C-F539DEF96DCB\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1022_\\\\(9786-22h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1022_\\\\(9786-22h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2C09090-C18F-464A-8DEF-E23B5990E2A4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1024_\\\\(9786-42h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1024_\\\\(9786-42h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0170400B-89A7-4B44-9AA7-9A168C9CAE9C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1050_\\\\(9043-mrx\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1050_\\\\(9043-mrx\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"061D193E-84BC-4DE7-96C4-B75D11769ED5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1012_\\\\(9028-21b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.81\",\"matchCriteriaId\":\"0524365D-8379-4B10-B9C5-FF80EE84BA27\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1012_\\\\(9028-21b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BED85F2-8CCB-417C-A739-23828966A036\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1180_\\\\(9080-heu\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.31\",\"matchCriteriaId\":\"E8049F52-227B-4CCA-B059-5821F9B41C95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1180_\\\\(9080-heu\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F518B3DD-3F25-4581-9103-6CD4D8DA54C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1180_\\\\(9080-heu\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s922_\\\\(9009-22g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"0C406C5A-454C-4454-861F-80E629B68418\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s922_\\\\(9009-22g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95E5E77F-A5BB-46E7-B6B6-B02F242DE829\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_h922_\\\\(9223-22s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"FBE7D8B3-902D-4CD1-9F31-454E293A79B3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_h922_\\\\(9223-22s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7851003-8D6B-4FE8-87D7-BE968E85E448\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s914_\\\\(9009-41g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"CD77C09F-AF62-4CD8-B64C-CDF50D696648\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s914_\\\\(9009-41g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"003F591A-ACCD-497E-BF8A-DE090321D778\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s924_\\\\(9009-42g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"54831AF9-D748-4649-A0ED-896341845BCD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s924_\\\\(9009-42g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_h924_\\\\(9223-42s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"64FD3222-EEFD-4533-A088-B05F04E0831D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_h924_\\\\(9223-42s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e950_\\\\(9040-mr9\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"C99CF91B-A98D-4795-A8AE-998713989ABE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e950_\\\\(9040-mr9\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e980_\\\\(9080-m9s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"272B1267-28AC-4BDB-93C4-9804DBE240E0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e980_\\\\(9080-m9s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BE56BD8-DB0F-4151-9428-42F1B6452D99\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7283235\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16707\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T15:47:50.423730Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T15:48:32.115Z\"}}], \"cna\": {\"title\": \"Power System Out-of-bounds Read\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"PowerVM Hypervisor\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW1120.00\"}, {\"status\": \"affected\", \"version\": \"FW1110.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW1110.30\"}, {\"status\": \"affected\", \"version\": \"FW1060.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW1060.80\"}, {\"status\": \"affected\", \"version\": \"FW950.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW950.H2\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers with the products below should install FW1110.31(1110_134), FW1120.01(1120_167), or newer to remediate this vulnerability.\\nPower 11\\n\\n  *  IBM Power System E1180 (9080-HEU)\\n\\n\\nCustomers with the products below should install FW1110.31(1110_155), FW1120.01(1120_190), or newer to remediate this vulnerability.\\nPower 11\\n\\n  *  IBM Power System S1122 (9824-22A)\\n  *  IBM Power System S1124 (9824-42A)\\n  *  IBM Power System S1122s (9824-22B)\\n  *  IBM Power System S1114 (9824-41B)\\n  *  IBM Power System L1122 (9856-22H)\\n  *  IBM Power System L1124 (9856-42H)\\n  *  IBM Power System E1150 (9043-MRU)\\n\\n\\nCustomers with the products below should install FW1120.01(1120_190), or newer to remediate this vulnerability.\\n\\n\\n\\nPower 11\\n\\n  *  IBM Power System S1112 (9242-21B, 9242-21T)\\n\\n\\n\\nCustomers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.\\nPower 10\\n\\n  *  IBM Power System E1080 (9080-HEX)\\n\\n\\nCustomers with the products below should install\\u00a0 FW1060.81(1060_191), or newer to remediate this vulnerability.\\nPower 10\\n\\n  *  IBM Power System S1022 (9105-22A)\\n  *  IBM Power System S1024 (9105-42A)\\n  *  IBM Power System S1022s (9105-22B)\\n  *  IBM Power System S1014 (9105-41B)\\n  *  IBM Power System L1022 (9786-22H)\\n  *  IBM Power System L1024 (9786-42H)\\n  *  IBM Power System E1050 (9043-MRX)\\n  *  IBM Power System S1012 (9028-21B)\\n\\n\\n\\n\\n\\n\\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\\nPower 9\\n\\n  *  IBM Power System S922 (9009-22G)\\n  *  IBM Power System H922 (9223-22S)\\n  *  IBM Power System S914 (9009-41G)\\n  *  IBM Power System S924 (9009-42G)\\n  *  IBM Power System H924 (9223-42S)\\n  *  IBM Power System E950 (9040-MR9)\\n  *  IBM Power System E980 (9080-M9S)\\n\\n\\n\\n\\n\\n\\nThe images mentioned above can be located at IBM Fix Central :  https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCustomers with the products below should install FW1110.31(1110_134), FW1120.01(1120_167), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1180 (9080-HEU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1110.31(1110_155), FW1120.01(1120_190), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1122 (9824-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1124 (9824-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1122s (9824-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1114 (9824-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1122 (9856-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1124 (9856-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1150 (9043-MRU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1120.01(1120_190), or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1112 (9242-21B, 9242-21T)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cbr/\u003eCustomers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1080 (9080-HEX)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install\\u00a0 FW1060.81(1060_191), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1022 (9105-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1024 (9105-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1022s (9105-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1014 (9105-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1022 (9786-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1024 (9786-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1050 (9043-MRX)\u003c/li\u003e\u003cli\u003eIBM Power System S1012 (9028-21B)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\u003cbr/\u003ePower 9\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S922 (9009-22G)\u003c/li\u003e\u003cli\u003eIBM Power System H922 (9223-22S)\u003c/li\u003e\u003cli\u003eIBM Power System S914 (9009-41G)\u003c/li\u003e\u003cli\u003eIBM Power System S924 (9009-42G)\u003c/li\u003e\u003cli\u003eIBM Power System H924 (9223-42S)\u003c/li\u003e\u003cli\u003eIBM Power System E950 (9040-MR9)\u003c/li\u003e\u003cli\u003eIBM Power System E980 (9080-M9S)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eThe images mentioned above can be located at IBM Fix Central : \u003c/em\u003e\u003ca href=\\\"https://www.ibm.com/support/fixcentral/\\\" rel=\\\"noopener noreferrer nofollow\\\"\u003e\u003cem\u003ehttps://www.ibm.com/support/fixcentral/\u003c/em\u003e\u003c/a\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7283235\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-08-19T20:09:07.749Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-16707\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-21T03:57:27.564Z\", \"dateReserved\": \"2026-07-23T01:58:36.625Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-08-19T20:09:07.749Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-16707

Vulnerability from fkie_nvd - Published: 2026-08-19 20:17 - Updated: 2026-08-25 19:34

Severity

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7283235	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	power_system_s1122_\(9824-22a\)_firmware	*
ibm	power_system_s1122_\(9824-22a\)_firmware	fw1120.00
ibm	power_system_s1122_\(9824-22a\)	-
ibm	power_system_s1124_\(9824-42a\)_firmware	*
ibm	power_system_s1124_\(9824-42a\)_firmware	fw1120.00
ibm	power_system_s1124_\(9824-42a\)	-
ibm	power_system_s1122s_\(9824-22b\)_firmware	*
ibm	power_system_s1122s_\(9824-22b\)_firmware	fw1120.00
ibm	power_system_s1122s_\(9824-22b\)	-
ibm	power_system_s1114_\(9824-41b\)_firmware	*
ibm	power_system_s1114_\(9824-41b\)_firmware	fw1120.00
ibm	power_system_s1114_\(9824-41b\)	-
ibm	power_system_l1122_\(9856-22h\)_firmware	*
ibm	power_system_l1122_\(9856-22h\)_firmware	fw1120.00
ibm	power_system_l1122_\(9856-22h\)	-
ibm	power_system_l1124_\(9856-42h\)_firmware	*
ibm	power_system_l1124_\(9856-42h\)_firmware	fw1120.00
ibm	power_system_l1124_\(9856-42h\)	-
ibm	power_system_e1150_\(9043-mru\)_firmware	*
ibm	power_system_e1150_\(9043-mru\)_firmware	fw1120.00
ibm	power_system_e1150_\(9043-mru\)	-
ibm	power_system_s1112_\(9242-21b\)_firmware	fw1120.00
ibm	power_system_s1112_\(9242-21b\)	-
ibm	power_system_s1112_\(9242-21t\)_firmware	fw1120.00
ibm	power_system_s1112_\(9242-21t\)	-
ibm	power_system_e1080_\(9080-hex\)_firmware	*
ibm	power_system_e1080_\(9080-hex\)	-
ibm	power_system_s1022_\(9105-22a\)_firmware	*
ibm	power_system_s1022_\(9105-22a\)	-
ibm	power_system_s1024_\(9105-42a\)_firmware	*
ibm	power_system_s1024_\(9105-42a\)	-
ibm	power_system_s1022s_\(9105-22b\)_firmware	*
ibm	power_system_s1022s_\(9105-22b\)	-
ibm	power_system_s1014_\(9105-41b\)_firmware	*
ibm	power_system_s1014_\(9105-41b\)	-
ibm	power_system_l1022_\(9786-22h\)_firmware	*
ibm	power_system_l1022_\(9786-22h\)	-
ibm	power_system_l1024_\(9786-42h\)_firmware	*
ibm	power_system_l1024_\(9786-42h\)	-
ibm	power_system_e1050_\(9043-mrx\)_firmware	*
ibm	power_system_e1050_\(9043-mrx\)	-
ibm	power_system_s1012_\(9028-21b\)_firmware	*
ibm	power_system_s1012_\(9028-21b\)	-
ibm	power_system_e1180_\(9080-heu\)_firmware	*
ibm	power_system_e1180_\(9080-heu\)_firmware	fw1120.00
ibm	power_system_e1180_\(9080-heu\)	-
ibm	power_system_s922_\(9009-22g\)_firmware	*
ibm	power_system_s922_\(9009-22g\)	-
ibm	power_system_h922_\(9223-22s\)_firmware	*
ibm	power_system_h922_\(9223-22s\)	-
ibm	power_system_s914_\(9009-41g\)_firmware	*
ibm	power_system_s914_\(9009-41g\)	-
ibm	power_system_s924_\(9009-42g\)_firmware	*
ibm	power_system_s924_\(9009-42g\)	-
ibm	power_system_h924_\(9223-42s\)_firmware	*
ibm	power_system_h924_\(9223-42s\)	-
ibm	power_system_e950_\(9040-mr9\)_firmware	*
ibm	power_system_e950_\(9040-mr9\)	-
ibm	power_system_e980_\(9080-m9s\)_firmware	*
ibm	power_system_e980_\(9080-m9s\)	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"
          ],
          "product": "PowerVM Hypervisor",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "FW1120.00"
            },
            {
              "lessThanOrEqual": "FW1110.30",
              "status": "affected",
              "version": "FW1110.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "FW1060.80",
              "status": "affected",
              "version": "FW1060.00",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "FW950.H2",
              "status": "affected",
              "version": "FW950.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C016EFBA-A371-4264-A823-A7635D39F6D9",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8707806-84E4-442B-A29F-7BF44514F8DA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "96C2DEDC-012D-4B9F-B9DF-344A49B67E46",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B512BF5-7D6B-45EA-97B8-F22B63A62270",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "25BCA648-5FF1-4B90-98ED-23E5BB217465",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F51514A-8E29-42D1-B874-838F8A0869D2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC8256E1-574D-4666-BE1B-45977348AC86",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "2165EAA9-EDC9-4010-9D31-294F9414A9E6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26E1E16B-8F95-46EC-BAA0-0A53F332292B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F8C1054-A539-468C-9A5F-E6E686C6CE8A",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "085F1C27-D806-4E4B-A44A-BB3C056CFCF7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8688E552-BE38-4EB9-8514-D7060C548C39",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "37868E6E-7759-4CCB-995E-BDB7F61F6818",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "50916B93-7340-4344-AF34-91836ABE508F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C8998E4-5EA9-4C7E-BF59-644CB78D00D2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F0FE92C-3510-475A-8D02-ED17ADD87CD0",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "FECCD687-64E7-45B4-BCB7-AEF25164D049",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC4CCBFC-3120-475D-BF75-025C04E41B91",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE428FBB-4DDC-4E05-A5C3-F37BE9395723",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC9D9EFF-1E92-4894-9976-001227F78869",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "6505E499-E766-451D-9996-1668BE53AAF8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3F5100A-FE2A-412C-9B57-B616B97B1142",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "109DE27E-5F87-4BD0-8C48-F72A1C2AD55D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA825307-2083-4264-8E8B-798661285261",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA6D803F-DD5C-49A7-BE93-68981C124C69",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF85251B-E02C-4293-98F0-D331BF51CAC4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BB54554-C9DC-4072-A205-EA9DD4E15688",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3E15C41-9CBD-4F66-A176-07B3E9BBD81D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA4B835D-CEAB-422B-9F38-F63AF84396C3",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E49EE658-B8AE-48F7-A765-92BA3A630AA0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "51C2576F-E4DD-4002-9E41-CF89F92E2064",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "564A665A-7B94-40CE-A4D9-CDD0CCF52B2E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "41572D5A-C3A2-4294-9AF9-D4824675B4A3",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECD54B80-5754-4C19-AE0C-F539DEF96DCB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2C09090-C18F-464A-8DEF-E23B5990E2A4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0170400B-89A7-4B44-9AA7-9A168C9CAE9C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "061D193E-84BC-4DE7-96C4-B75D11769ED5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0524365D-8379-4B10-B9C5-FF80EE84BA27",
              "versionEndExcluding": "fw1060.81",
              "versionStartIncluding": "fw1060.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BED85F2-8CCB-417C-A739-23828966A036",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8049F52-227B-4CCA-B059-5821F9B41C95",
              "versionEndExcluding": "fw1110.31",
              "versionStartIncluding": "fw1110.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "F518B3DD-3F25-4581-9103-6CD4D8DA54C7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C406C5A-454C-4454-861F-80E629B68418",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "95E5E77F-A5BB-46E7-B6B6-B02F242DE829",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBE7D8B3-902D-4CD1-9F31-454E293A79B3",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7851003-8D6B-4FE8-87D7-BE968E85E448",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD77C09F-AF62-4CD8-B64C-CDF50D696648",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "003F591A-ACCD-497E-BF8A-DE090321D778",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "54831AF9-D748-4649-A0ED-896341845BCD",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4038C5DB-DF9C-4661-9590-F6A0CD4D15D5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64FD3222-EEFD-4533-A088-B05F04E0831D",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2F0E93A-26F0-4914-8A31-3C86E64D5B8A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C99CF91B-A98D-4795-A8AE-998713989ABE",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FF58E5C-0A54-4F2F-A426-0BFD1EACE991",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "272B1267-28AC-4BDB-93C4-9804DBE240E0",
              "versionEndExcluding": "fw950.h3",
              "versionStartIncluding": "fw950.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BE56BD8-DB0F-4151-9428-42F1B6452D99",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system."
    }
  ],
  "id": "CVE-2026-16707",
  "lastModified": "2026-08-25T19:34:20.303",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-16707",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-19T20:17:02.140",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7283235"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8PM5-M8H3-36WW

Vulnerability from github – Published: 2026-08-19 21:30 – Updated: 2026-08-19 21:30

Details

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-16707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T20:17:02Z",
    "severity": "HIGH"
  },
  "details": "IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.",
  "id": "GHSA-8pm5-m8h3-36ww",
  "modified": "2026-08-19T21:30:33Z",
  "published": "2026-08-19T21:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16707"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7283235"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-16707 (GCVE-0-2026-16707)

FKIE_CVE-2026-16707

GHSA-8PM5-M8H3-36WW

Tags

Sightings

Nomenclature