CVE-2026-18821
HIGH 7.5IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 9th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-18821/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-18821/poc.json
Affected
Vendors Ibm
Products Powervm Hypervisor Power System S1122 \(9824 22a\) Firmware Power System S1122 \(9824 22a\) Power System S1124 \(9824 42a\) Firmware Power System S1124 \(9824 42a\) Power System S1122s \(9824 22b\) Firmware Power System S1122s \(9824 22b\) Power System S1114 \(9824 41b\) Firmware Power System S1114 \(9824 41b\) Power System L1122 \(9856 22h\) Firmware Power System L1122 \(9856 22h\) Power System L1124 \(9856 42h\) Firmware
Weakness (CWE)
- CWE-787: Out-of-bounds Write
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Ibm | Power System S1122 \(9824 22a\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System S1122 \(9824 22a\) Firmware | fw1120.00 |
| Ibm | Power System S1124 \(9824 42a\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System S1124 \(9824 42a\) Firmware | fw1120.00 |
| Ibm | Power System S1122s \(9824 22b\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System S1122s \(9824 22b\) Firmware | fw1120.00 |
| Ibm | Power System S1114 \(9824 41b\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System S1114 \(9824 41b\) Firmware | fw1120.00 |
| Ibm | Power System L1122 \(9856 22h\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System L1122 \(9856 22h\) Firmware | fw1120.00 |
| Ibm | Power System L1124 \(9856 42h\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System L1124 \(9856 42h\) Firmware | fw1120.00 |
| Ibm | Power System E1150 \(9043 Mru\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System E1150 \(9043 Mru\) Firmware | fw1120.00 |
| Ibm | Power System S1112 \(9242 21b\) Firmware | fw1120.00 |
| Ibm | Power System S1112 \(9242 21t\) Firmware | fw1120.00 |
| Ibm | Power System E1080 \(9080 Hex\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System S1022 \(9105 22a\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System S1024 \(9105 42a\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System S1022s \(9105 22b\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System S1014 \(9105 41b\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System L1022 \(9786 22h\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System L1024 \(9786 42h\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System E1050 \(9043 Mrx\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System S1012 \(9028 21b\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System E1180 \(9080 Heu\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System E1180 \(9080 Heu\) Firmware | fw1120.00 |
| Ibm | Power System S922 \(9009 22g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System H922 \(9223 22s\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System S914 \(9009 41g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System S924 \(9009 42g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System H924 \(9223 42s\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System E950 \(9040 Mr9\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System E980 \(9080 M9s\) Firmware | ≥ fw950.00 and < fw950.h3 |
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - HIGH 8.8 v3.1 · NVD Primary
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H