CVE-2026-18848
HIGH 8.3IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
Severe if exploited (CVSS 8.3), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 1st percentile
Impact if exploited
8.3CVSS 3.1 · HIGH
- ConfidentialityLow
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-18848/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-18848/poc.json
Affected
Vendors Ibm
Products Power Systems Firmware Power System E1080 \(9080 Hex\) Firmware Power System E1080 \(9080 Hex\) Power System E1180 \(9080 Heu\) Firmware Power System E1180 \(9080 Heu\) Power System S922 \(9009 22g\) Firmware Power System S922 \(9009 22g\) Power System H922 \(9223 22s\) Firmware Power System H922 \(9223 22s\) Power System S914 \(9009 41g\) Firmware Power System S914 \(9009 41g\) Power System S924 \(9009 42g\) Firmware
Weakness (CWE)
- CWE-352: Cross-Site Request Forgery (CSRF)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Ibm | Power System E1080 \(9080 Hex\) Firmware | ≥ fw1060.00 and < fw1060.81 |
| Ibm | Power System E1180 \(9080 Heu\) Firmware | ≥ fw1110.00 and < fw1110.31 |
| Ibm | Power System E1180 \(9080 Heu\) Firmware | fw1120.00 |
| Ibm | Power System S922 \(9009 22g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System H922 \(9223 22s\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System S914 \(9009 41g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System S924 \(9009 42g\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System H924 \(9223 42s\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System E950 \(9040 Mr9\) Firmware | ≥ fw950.00 and < fw950.h3 |
| Ibm | Power System E980 \(9080 M9s\) Firmware | ≥ fw950.00 and < fw950.h3 |
All CVSS metrics
- HIGH 8.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - HIGH 8.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H