CVE-2026-16661

HighCVSS 8.2

Published: 19/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

IBM PowerVM Hypervisor (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system.

Risk Assessment

Successful exploitation can impact confidentiality, integrity, and availability of the managed system.

Recommendation

Apply patches provided by IBM and restrict service-level access to the FSP to trusted personnel only.

Original NVD description (English source)

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.