CVE-2026-16687
published 2026-08-19CVE-2026-16687: IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in…
PriorityP262critical9.6CVSS 3.1
AVAACLPRNUINSCCHIHAH
EPSS
0.35%
27.1th percentile
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | power_system_e1080_firmware | >= fw1060.00 < fw1060.81 | fw1060.81 |
| ibm | power_system_e1180_firmware | — | — |
| ibm | power_system_e1180_firmware | >= fw1110.00 < fw1110.31 | fw1110.31 |
| ibm | power_system_e950_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_e980_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_h922_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_h924_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_s914_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_s922_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_system_s924_firmware | >= fw950.00 < fw950.h3 | fw950.h3 |
| ibm | power_systems_firmware | — | — |
| ibm | power_systems_firmware | FW1060.00 – FW1060.80 | — |
| ibm | power_systems_firmware | FW1110.00 – FW1110.30 | — |
| ibm | power_systems_firmware | FW950.00 – FW950.H2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Power Systems up to FW950.H2/FW1060.80/FW1110.30/FW1120.00 ASMI Web Interface stack-based overflow
vuldb·2026-08-23·CVSS 9.6
CVE-2026-16687 [CRITICAL] IBM Power Systems up to FW950.H2/FW1060.80/FW1110.30/FW1120.00 ASMI Web Interface stack-based overflow
A vulnerability identified as very critical has been detected in IBM Power Systems up to FW950.H2/FW1060.80/FW1110.30/FW1120.00. The affected element is an unknown function of the component ASMI Web Interface. The manipulation leads to stack-based buffer overflow.
This vulnerability is documented as CVE-2026-16687. The attack can be initiated remotely. There is not any exploit available.
GHSA
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface.
ghsa_unreviewed·2026-08-19
CVE-2026-16687 [CRITICAL] CWE-121 IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface.
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-19
Published