IBM Openbmc vulnerabilities

4 CVEs affecting IBM Openbmc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18849, published 2026-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-31916, published 2024-06-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.
CVE-2024-35124, published 2024-08-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker…
CVE-2026-7254, published 2026-05-27. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
CVE-2026-18849, published 2026-08-19. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific…