CVE-2026-16678: CWE-772 Missing Release of Resource after Effective Lifetime in IBM Virtualization Management Interface

This vulnerability, identified as CWE-772 (Missing Release of Resource after Effective Lifetime), affects specific versions of IBM Power Systems Firmware for the Virtualization Management Interface. The flaw allows a remote authenticated attacker to exhaust connection resources by exploiting improper resource management, leading to denial of service conditions. The CVSS 3.1 base score is 4.5, indicating medium severity, with attack vector requiring adjacent network access, low attack complexity, and high privileges. There is no indication of confidentiality or integrity impact, only availability is affected.

An attacker with remote authenticated access can cause a denial of service by exhausting connection resources on affected IBM Virtualization Management Interface firmware versions. This could disrupt management operations but does not impact confidentiality or integrity of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, monitor for vendor updates and consider limiting access to the affected management interfaces to trusted administrators only.