CVE-2026-17093 IBM CVE debrief

Who should care

IBM Power Systems administrators and users, IBM Power Systems Firmware owners, security teams, and vulnerability management teams should be aware of this vulnerability and take necessary actions to mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also monitor system configuration and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Finally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. The vulnerability has a high CVSS score of 8.2 and can have a significant impact on the confidentiality, integrity, and availability of the affected systems. Therefore, it is essential for these stakeholders to take immediate action to mitigate the vulnerability and prevent potential attacks. The affected products and components include IBM Power Systems Firmware, and the vulnerability class is related to host firmware configuration parsing. The likely operational impact is significant, and the source-confidence limits are based on the official CVE record and vendor advisory. The review context is critical, and the stakeholders should carefully evaluate the vulnerability and take necessary actions to mitigate it. The vulnerability affects a wide range of IBM Power Systems Firmware versions, including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC). The stakeholders should be aware of the affected scope and take necessary actions to mitigate the vulnerability. The vulnerability management teams should prioritize the mitigation of this vulnerability based on its high CVSS score and potential impact on the affected systems. The IBM

Technical summary

IBM Power Systems Firmware vulnerability in host firmware configuration parsing allows for confidentiality, integrity, and availability impact. The vulnerability affects IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC). An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it.

Defensive priority

IBM Power Systems Firmware vulnerability allows for confidentiality, integrity, and availability impact. Apply vendor patches immediately.

Recommended defensive actions

• Apply IBM Power Systems Firmware patches
• Restrict access to BMC/FSP
• Monitor system configuration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

IBM Power Systems Firmware vulnerability in host firmware configuration parsing allows for confidentiality, integrity, and availability impact. Limited evidence available. The vulnerability affects IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.