CVE-2026-16707: IBM Power System e1050 (9043-Mrx) Firmware

High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days.

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

Affected products

  • IBM Power System e1050 (9043-Mrx) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System e1080 (9080-Hex) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System e1150 (9043-Mru) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System e1180 (9080-Heu) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System e950 (9040-MR9) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • IBM Power System e980 (9080-m9s) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • IBM Power System h922 (9223-22s) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • IBM Power System h924 (9223-42s) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • IBM Power System l1022 (9786-22h) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System l1024 (9786-42h) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System l1122 (9856-22h) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System l1124 (9856-42h) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System s1012 (9028-21b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System s1014 (9105-41b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System s1022 (9105-22a) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System s1022s (9105-22b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System s1024 (9105-42a) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
  • IBM Power System s1112 (9242-21b) Firmware: version fw1120.00 only
  • IBM Power System s1112 (9242-21t) Firmware: version fw1120.00 only
  • IBM Power System s1114 (9824-41b) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System s1122 (9824-22a) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System s1122s (9824-22b) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System s1124 (9824-42a) Firmware: from fw1110.00, before fw1110.31 (fixed in fw1110.31); version fw1120.00 only
  • IBM Power System s914 (9009-41g) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • IBM Power System s922 (9009-22g) Firmware: from fw950.00, before fw950.h3 (fixed in fw950.h3)
  • and 1 more

Published 2026-08-19. Last modified 2026-08-25.