IBM disclosed a critical stack-based buffer overflow in the ASMI web interface of Power Systems Firmware that lets an unauthenticated attacker on an adjacent network execute arbitrary code and take full control of the managed system.
What Is It
CVE-2026-16687 is a stack-based buffer overflow (CWE-121) in the Advanced System Management Interface (ASMI) web interface of IBM Power Systems Firmware. An unauthenticated attacker with network access can send the Flexible Service Processor (FSP) a malformed request, resulting in arbitrary code execution. IBM's PSIRT scored it CVSS 3.1 9.6 (Critical) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Why It Matters
The vector tells the story: no privileges, no user interaction, low attack complexity, and a changed scope: compromise of the service processor extends beyond the vulnerable component itself. Per IBM's description, successful exploitation gives the attacker full control over the managed system, with high impact to confidentiality, integrity, and availability.
The one mitigating factor is the attack vector: AV:A (adjacent network), not fully remote. Exploitation requires access to the network segment reachable by the FSP. Management networks that are flat, bridged to general corporate VLANs, or otherwise not isolated erase that limitation in practice.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time.
What's Vulnerable
IBM Power Systems Firmware, at the following levels:
- FW1120.00
- FW1110.00 through FW1110.30
- FW1060.00 through FW1060.80
- FW950.00 through FW950.H2
Patch Status
IBM published a support bulletin for this issue (node 7283893). The supplied NVD record, dated 2026-08-19, is in Received status and does not enumerate fixed firmware levels; consult the IBM advisory directly for the remediated build for your affected release train. No specific required-action deadline is present in the supplied data, as this CVE is not listed in the provided KEV material.
Until firmware is applied, restrict network reachability to the FSP/ASMI interface to a dedicated, isolated management network.
Sources
- NVD, CVE-2026-16687: https://nvd.nist.gov/vuln/detail/CVE-2026-16687
- IBM Support (PSIRT advisory): https://www.ibm.com/support/pages/node/7283893