CVE-2026-16835 is an improper certificate validation vulnerability (CWE-295) in IBM Power Systems Firmware affecting multiple firmware versions. The vulnerability resides in the FSP management network protocol, enabling an unauthenticated attacker with access to the management network to bypass authentication mechanisms. This bypass grants the attacker full administrative control over the managed system, including the ability to manipulate partition power states, configurations, and console access for all hosted partitions. The vulnerability has a CVSS 3.1 base score of 9.6, indicating critical severity with high impact on confidentiality, integrity, and availability.

An unauthenticated attacker on the management network can gain full administrative privileges on the affected IBM Power Systems. This includes control over partition power states, system configuration, and console access, potentially leading to complete system compromise affecting confidentiality, integrity, and availability of the managed system and all hosted partitions.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the management network to trusted personnel only and monitor for unauthorized access attempts.