CVE-2026-16835 json
Power System Improper Certificate Validation
published 2mo ago modified 2mo ago also EUVD-2026-62691
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
Patch / fix
- ibm power_system_e1080_(9080-hex)_firmware fw1060.81
- ibm power_system_e1180_(9080-heu)_firmware fw1110.31
- ibm power_system_s922_(9009-22g)_firmware fw950.h3
- ibm power_system_h922_(9223-22s)_firmware fw950.h3
- ibm power_system_s914_(9009-41g)_firmware fw950.h3
- ibm power_system_s924_(9009-42g)_firmware fw950.h3
- ibm power_system_h924_(9223-42s)_firmware fw950.h3
- ibm power_system_e950_(9040-mr9)_firmware fw950.h3
- ibm power_system_e980_(9080-m9s)_firmware fw950.h3
- ibm.com/support/pages/node/7283894 advisory
Is CVE-2026-16835 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
- IBM Power Systems Firmware
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
ibm.com
/support/pages/node/7283894
vendor-advisory, patch
Sources
- CVE List CVE-2026-16835
- NVD CVE-2026-16835
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.