IBM Power Systems Firmware: Improper memory buffer restriction in FSP mailbox
Summary
IBM Power Systems Firmware FW1060.00 through FW1060.81 contains a flaw in the service processor mailbox interface between the Flexible Service Processor (FSP) and Hostboot. An attacker with authenticated service-level access to the FSP can send a crafted mailbox message to read or modify arbitrary regions of Hostboot memory. A successful attack can compromise the host firmware boot stack and the PowerVM hypervisor loaded by it, with high impact on confidentiality, integrity and availability of the managed system.
Affected
- IBM Power Systems Firmware FW1060.00 through FW1060.81 (PowerVM Hypervisor)
- Power 10 systems, including S1022, S1024, S1022s, S1014, L1022, L1024, E1050 and S1012
Fixed in
- FW1060.82 (build 1060_199) or newer, available through IBM Fix Central
Workaround
Unknown. IBM lists no workaround or mitigation.
Exploitation
- No known exploitation in the wild.
- No public proof of concept reported.
- EPSS score 0.00169 (very low).
- CISA SSVC: exploitation none, not automatable.
Our recommendation
- Check whether the affected Power 10 systems run FW1060.00 to FW1060.81 and plan the update to FW1060.82 (1060_199) or newer.
- Restrict network access to FSP and HMC management interfaces and review who holds service-level credentials.
- Monitor management access logs for unusual service-level activity until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin for CVE-2026-96265 www.ibm.com
- OpenCVE: CVE-2026-96265 app.opencve.io
- VulDB: CVE-2026-96265 vuldb.com
- The Hacker Wire: CVE-2026-96265 www.thehackerwire.com
- Threat Intelligence: CVE-2026-96265 CVSS data cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:35.
Original description (NVD)
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.