CVE-2026-18871
Estado: AnalizadaAlta (7.3)—
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
- Puntuación base: 7.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.14%
- Percentil entre todas las CVEs puntuadas: 3
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 % - Impacto principal
T1499.004Application or System Exploitationimpact75 % - Impacto secundario
T1565.001Stored Data Manipulationimpact70 %
AV:L + PR:L sin UI indica escalada local. Corrupción de memoria y crash del firmware (Availability e Integrity) durante boot: negación de servicio e integridad del sistema.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (19)
IBM — Power System E1050 (9043-mrx) FirmwareIBM — Power System E1080 (9080-hex) FirmwareIBM — Power System E1150 (9043-mru) FirmwareIBM — Power System E1180 (9080-heu) FirmwareIBM — Power System L1022 (9786-22h) FirmwareIBM — Power System L1024 (9786-42h) FirmwareIBM — Power System L1122 (9856-22h) FirmwareIBM — Power System L1124 (9856-42h) FirmwareIBM — Power System S1012 (9028-21b) FirmwareIBM — Power System S1014 (9105-41b) FirmwareIBM — Power System S1022 (9105-22a) FirmwareIBM — Power System S1022s (9105-22b) FirmwareIBM — Power System S1024 (9105-42a) FirmwareIBM — Power System S1112 (9242-21b) FirmwareIBM — Power System S1112 (9242-21t) FirmwareIBM — Power System S1114 (9824-41b) FirmwareIBM — Power System S1122 (9824-22a) FirmwareIBM — Power System S1122s (9824-22b) FirmwareIBM — Power System S1124 (9824-42a) Firmware
CWE
- CWE-121
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-18871",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-18871",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-08-20T15:43:28.627822Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@us.ibm.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.3,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 4.7,
"exploitabilityScore": 2
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*"
],
"vendor": "IBM",
"product": "PowerVM Hypervisor",
"versions": [
{
"status": "affected",
"version": "FW1120.00"
},
{
"status": "affected",
"version": "FW1110.00",
"versionType": "semver",
"lessThanOrEqual": "FW1110.30"
},
{
"status": "affected",
"version": "FW1060.00",
"versionType": "semver",
"lessThanOrEqual": "FW1060.80"
}
]
}
]
}
],
"published": "2026-08-19T20:17:13.763",
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7283238",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@us.ibm.com",
"description": [
{
"lang": "en",
"value": "CWE-121"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system."
}
],
"lastModified": "2026-08-25T20:39:34.857",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C016EFBA-A371-4264-A823-A7635D39F6D9",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8707806-84E4-442B-A29F-7BF44514F8DA"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "96C2DEDC-012D-4B9F-B9DF-344A49B67E46"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B512BF5-7D6B-45EA-97B8-F22B63A62270",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25BCA648-5FF1-4B90-98ED-23E5BB217465"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3F51514A-8E29-42D1-B874-838F8A0869D2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC8256E1-574D-4666-BE1B-45977348AC86",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2165EAA9-EDC9-4010-9D31-294F9414A9E6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "26E1E16B-8F95-46EC-BAA0-0A53F332292B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F8C1054-A539-468C-9A5F-E6E686C6CE8A",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "085F1C27-D806-4E4B-A44A-BB3C056CFCF7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8688E552-BE38-4EB9-8514-D7060C548C39"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37868E6E-7759-4CCB-995E-BDB7F61F6818",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50916B93-7340-4344-AF34-91836ABE508F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F0FE92C-3510-475A-8D02-ED17ADD87CD0",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FECCD687-64E7-45B4-BCB7-AEF25164D049"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC4CCBFC-3120-475D-BF75-025C04E41B91",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE428FBB-4DDC-4E05-A5C3-F37BE9395723"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AC9D9EFF-1E92-4894-9976-001227F78869"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6505E499-E766-451D-9996-1668BE53AAF8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B3F5100A-FE2A-412C-9B57-B616B97B1142"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "109DE27E-5F87-4BD0-8C48-F72A1C2AD55D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EA825307-2083-4264-8E8B-798661285261"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA6D803F-DD5C-49A7-BE93-68981C124C69",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DF85251B-E02C-4293-98F0-D331BF51CAC4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BB54554-C9DC-4072-A205-EA9DD4E15688",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA4B835D-CEAB-422B-9F38-F63AF84396C3",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E49EE658-B8AE-48F7-A765-92BA3A630AA0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51C2576F-E4DD-4002-9E41-CF89F92E2064",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41572D5A-C3A2-4294-9AF9-D4824675B4A3",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ECD54B80-5754-4C19-AE0C-F539DEF96DCB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B2C09090-C18F-464A-8DEF-E23B5990E2A4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0170400B-89A7-4B44-9AA7-9A168C9CAE9C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "061D193E-84BC-4DE7-96C4-B75D11769ED5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0524365D-8379-4B10-B9C5-FF80EE84BA27",
"versionEndExcluding": "fw1060.81",
"versionStartIncluding": "fw1060.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7BED85F2-8CCB-417C-A739-23828966A036"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8049F52-227B-4CCA-B059-5821F9B41C95",
"versionEndExcluding": "fw1110.31",
"versionStartIncluding": "fw1110.00"
},
{
"criteria": "cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:fw1120.00:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F518B3DD-3F25-4581-9103-6CD4D8DA54C7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}