CVE-2021-20487: IBM POWER9 System Firmware

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.

Affected products

• IBM POWER9 System Firmware: from fw930.00, before fw930.30 (fixed in fw930.30); from fw940.00, before fw940.20 (fixed in fw940.20); before fw950.00 (fixed in fw950.00)
• IBM Scale-Out Lc System Firmware: before op940.20 (fixed in op940.20)

Published 2021-05-26. Last modified 2026-06-17.