CVSS 3.1
7.3 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:HCVE-2026-17042
High (7.3) in ibm. EPSS 0.1% chance of exploitation in the next 30 days.
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ibm:power_hardware_management_console_\(7063-cr2\)_firmware
- ibm:power_system_ac922_\(8335-gth\)_firmware
- ibm:power_system_ac922_\(8335-gtx\)_firmware
- ibm:power_system_e950_\(9040-mr9\)_firmware
- ibm:power_system_e980_\(9080-m9s\)_firmware
- ibm:power_system_h922_\(9223-22s\)_firmware
- ibm:power_system_h924_\(9223-42s\)_firmware
- ibm:power_system_s914_\(9009-41g\)_firmware
- ibm:power_system_s922_\(9009-22g\)_firmware
- ibm:power_system_s924_\(9009-42g\)_firmware