November 14, 2026

CVE Watchtower

CVE-2026-16687Ibm Power System E1180 \(9080-heu\) Firmware >= fw1110.00 and < fw1110.31 Stack-based Buffer Overflow

NVDCVSS scored by psirt@us.ibm.com

Vulnerability Summary

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
Severity Level
CRITICAL(9.6)
Published Date
Aug 19, 2026
Last Modified
Aug 25, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.21%Probability
Root Weakness (CWE)
CWE-121: Stack-based Buffer Overflow β†—
The buffer being overwritten is allocated on the stack.
CVSS v3.1 Base Metrics — Score 9.6 (CRITICAL)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack VectorAdjacent
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Ibm Power System E1180 \(9080-heu\) Firmware >= fw1110.00 and < fw1110.31
  • Ibm Power System E1180 \(9080-heu\) Firmware
  • Ibm Power System E1080 \(9080-hex\) Firmware >= fw1060.00 and < fw1060.81
  • Ibm Power System S922 \(9009-22g\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System H922 \(9223-22s\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System S914 \(9009-41g\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System S924 \(9009-42g\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System H924 \(9223-42s\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System E950 \(9040-mr9\) Firmware >= fw950.00 and < fw950.h3
  • Ibm Power System E980 \(9080-m9s\) Firmware >= fw950.00 and < fw950.h3
Patched Versions
  • Ibm Power System E1180 \(9080-heu\) Firmware fw1110.31
  • Ibm Power System E1080 \(9080-hex\) Firmware fw1060.81
  • Ibm Power System S922 \(9009-22g\) Firmware fw950.h3
  • Ibm Power System H922 \(9223-22s\) Firmware fw950.h3
  • Ibm Power System S914 \(9009-41g\) Firmware fw950.h3
  • Ibm Power System S924 \(9009-42g\) Firmware fw950.h3
  • Ibm Power System H924 \(9223-42s\) Firmware fw950.h3
  • Ibm Power System E950 \(9040-mr9\) Firmware fw950.h3
  • Ibm Power System E980 \(9080-m9s\) Firmware fw950.h3

What to do

Plan remediation soon. No exploitation is confirmed yet, but the severity is critical.

  1. Check whether you run Ibm Power System E1180 \(9080-heu\) Firmware >= fw1110.00 and < fw1110.31 and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Aug 19, 2026Published
  • Aug 25, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new IBM CVEsYou are reading CVE-2026-16687. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about IBM CVEs

Related Coverage

External References

Data last checked: Nov 14, 2026 20:12 UTC