IBM Hardware Management Console vulnerabilities

15 CVEs affecting IBM Hardware Management Console, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12943, published 2026-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0495, published 2008-01-30. High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Pegasus CIM Server in IBM Hardware Management Console (HMC) 7 R3.2.0 allows remote attackers to cause a denial of service via unspecified vectors.
CVE-2008-5035, published 2008-11-10. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The Resource Monitoring and Control (RMC) daemon in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 and 3.3.0 SP2 allows remote attackers to cause a denial of service (daemon crash or hang)…
CVE-2009-0178, published 2009-01-20. High severity, CVSS 10.0. EPSS: 1.8% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 has unknown impact and attack vectors.
CVE-2007-6293, published 2007-12-10. High severity, CVSS 10.0. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 6 R1.3 allow attackers to gain privileges via "some HMC commands."
CVE-2009-1806, published 2009-05-28. High severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.4.0 SP2, when Active Memory Sharing is used, has unknown impact and attack vectors, related to a shared memory partition…
CVE-2026-12943, published 2026-07-30. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute…
CVE-2016-0230, published 2016-07-07. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3, 8.1 through 8.1.0 SP3, 8.2 through 8.2.0 SP2, 8.3 through 8.3.0 SP2, 8.4 through 8.4.0 SP1, and 8.5.0 allows…
CVE-2007-6305, published 2007-12-10. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 7 R3.2.0 allow attackers to gain privileges via "some HMC commands."
CVE-2007-6294, published 2007-12-10. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 3 R3.7 allow attackers to gain privileges via "some HMC commands."
CVE-2005-0539, published 2005-05-02. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Unknown vulnerability in IBM Hardware Management Console (HMC) before 4.4 for POWER5 servers allows local users to gain privileges, related to the Guided Setup Wizard.

Latest

CVE-2025-36125, published 2025-09-09. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in…
CVE-2025-1951, published 2025-04-22. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to execution of commands with unnecessary…
CVE-2025-1950, published 2025-04-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to improper validation of libraries of an untrusted source.
CVE-2023-38280, published 2023-10-16. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740.
CVE-2021-29707, published 2021-07-19. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879.