CVE-2026-96265 — IBM Power Systems Firmware Improper Memory Buffer Restriction
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level ac…
Published: 2026-10-12 · CVSS: 8.2 · CVSS 3.1
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7