CVE-2026-17042

published 2026-08-19

CVE-2026-17042: IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in…

Priority P3 41 high 7.3 CVSS 3.1

AV L AC L PR L UI N S C C N I L A H

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
ibm	power_hardware_management_console_firmware	>= op940 < op940.82	op940.82
ibm	power_system_ac922_firmware	>= op940 < op940.a2	op940.a2
ibm	power_system_e950_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_e980_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_h922_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_h924_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_s914_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_s922_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_system_s924_firmware	>= fw950.00 < fw950.h3	fw950.h3
ibm	power_systems_firmware	FW950.00 – FW950.H2	—
ibm	power_systems_firmware	OP940.00 – OP940.a1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-125