{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16938", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-24T07:44:31.605Z", "datePublished": "2026-08-19T18:48:32.835Z", "dateUpdated": "2026-08-19T18:59:17.561Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-19T18:59:17.561Z"}, "title": "Power System Missing Authorization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Power Systems Firmware", "versions": [{"status": "affected", "version": "FW1120.00"}, {"status": "affected", "version": "FW1110.00", "lessThanOrEqual": "FW1110.30", "versionType": "semver"}, {"status": "affected", "version": "FW1060.00", "lessThanOrEqual": "FW1060.80", "versionType": "semver"}, {"status": "affected", "version": "FW950.00", "lessThanOrEqual": "FW950.H2", "versionType": "semver"}], "cpes": ["cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention \u2014 clearing the affected configuration \u2014 to restore normal operation. Successful exploitation results in an availability impact to the managed system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention \u2014 clearing the affected configuration \u2014 to restore normal operation. Successful exploitation results in an availability impact to the managed system.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283896", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H"}}], "workarounds": [{"lang": "en", "value": "Protect access to the FSP's administrative interface.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Protect access to the FSP's administrative interface.</p>"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1120.01(1120_167), FW1110.31(1110_134), or newer to remediate this vulnerability.\n\n\n\nPower 11\n1) IBM Power System E1180 (9080-HEU)\n\n\n\nCustomers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System E1080 (9080-HEX)\n\n\n\nCustomers with the products below should install FW950.H3(950_230), or newer to remediate this vulnerability.\n\n\n\nPower9\n1) IBM Power System S922 (9009-22G)\n2) IBM Power System H922 (9223-22S)\n3) IBM Power System S914 (9009-41G)\n4) IBM Power System S924 (9009-42G)\n5) IBM Power System H924 (9223-42S)\n6) IBM Power System E950 (9040-MR9)\n7) IBM Power System E980 (9080-M9S)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Customers with the products below should install FW1120.01(1120_167), FW1110.31(1110_134), or newer to remediate this vulnerability.</p><p>Power 11<br/>1) IBM Power System E1180 (9080-HEU)</p><p>Customers with the products below should install FW1060.81(1060_184), or newer to remediate this vulnerability.</p><p>Power 10<br/>1) IBM Power System E1080 (9080-HEX)</p><p>Customers with the products below should install FW950.H3(950_230), or newer to remediate this vulnerability.</p><p>Power9<br/>1) IBM Power System S922 (9009-22G)<br/>2) IBM Power System H922 (9223-22S)<br/>3) IBM Power System S914 (9009-41G)<br/>4) IBM Power System S924 (9009-42G)<br/>5) IBM Power System H924 (9223-42S)<br/>6) IBM Power System E950 (9040-MR9)<br/>7) IBM Power System E980 (9080-M9S)</p><p>The images mentioned above can be located at IBM Fix Central : <a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/</a></p>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"], "product": "Power Systems Firmware", "vendor": "IBM", "versions": [{"status": "affected", "version": "FW1120.00"}, {"lessThanOrEqual": "FW1110.30", "status": "affected", "version": "FW1110.00", "versionType": "semver"}, {"lessThanOrEqual": "FW1060.80", "status": "affected", "version": "FW1060.00", "versionType": "semver"}, {"lessThanOrEqual": "FW950.H2", "status": "affected", "version": "FW950.00", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention \u2014 clearing the affected configuration \u2014 to restore normal operation. Successful exploitation results in an availability impact to the managed system."}], "id": "CVE-2026-16938", "lastModified": "2026-08-19T19:17:10.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2026-08-19T19:17:10.963", "references": [{"source": "[email protected]", "url": "https://www.ibm.com/support/pages/node/7283896"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "[email protected]", "type": "Primary"}]}

{}

{}