CVE-2026-16835 json
Power System Improper Certificate Validation
published 2026-08-19 2 mo ago modified 2026-08-25 2 mo ago also EUVD-2026-62691
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
Patch / fix
- ibm power_system_e1080_(9080-hex)_firmware fw1060.81
- ibm power_system_e1180_(9080-heu)_firmware fw1110.31
- ibm power_system_s922_(9009-22g)_firmware fw950.h3
- ibm power_system_h922_(9223-22s)_firmware fw950.h3
- ibm power_system_s914_(9009-41g)_firmware fw950.h3
- ibm power_system_s924_(9009-42g)_firmware fw950.h3
- ibm power_system_h924_(9223-42s)_firmware fw950.h3
- ibm power_system_e950_(9040-mr9)_firmware fw950.h3
- ibm power_system_e980_(9080-m9s)_firmware fw950.h3
- ibm.com/support/pages/node/7283894 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
- IBM Power Systems Firmware
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
ibm.com
/support/pages/node/7283894
vendor-advisory, patch
Sources
- CVE List CVE-2026-16835
- NVD CVE-2026-16835
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.