CVE-2026-18849: IBM Openbmc

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

Affected products

• IBM Openbmc: from fw1060.00, up to and including fw1060.80
• IBM Power System e1050 (9043-Mrx) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System l1022 (9786-22h) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System l1024 (9786-42h) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System s1012 (9028-21b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System s1014 (9105-41b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System s1022 (9105-22a) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System s1022s (9105-22b) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)
• IBM Power System s1024 (9105-42a) Firmware: from fw1060.00, before fw1060.81 (fixed in fw1060.81)

Published 2026-08-19. Last modified 2026-09-02.