CVE-2026-16832 is a stack-based buffer overflow vulnerability in IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The flaw exists in the FSP management network protocol and requires authenticated HMC administrator access to exploit. Successful exploitation allows arbitrary code execution on the service processor, granting full control over the managed system. The vulnerability impacts confidentiality, integrity, and availability of the system. The CVSS v3.1 base score is 8.4, reflecting high severity. No known exploits in the wild or vendor patches are currently documented.

An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, resulting in full system compromise. This affects confidentiality, integrity, and availability of the managed IBM Power Systems. The vulnerability enables complete control over the managed system via the service processor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict HMC administrator access to trusted personnel only and monitor for suspicious activity related to the FSP management network protocol.