CVE-2026-16835: CWE-295 Improper Certificate Validation in IBM Power Systems Firmware

CVE-2026-16835 is an improper certificate validation vulnerability (CWE-295) in IBM Power Systems Firmware affecting multiple firmware versions. The vulnerability exists in the FSP management network protocol, enabling an unauthenticated attacker with access to the management network to bypass authentication controls. This allows full administrative control over the managed system, including power state manipulation, configuration changes, and console access to all hosted partitions. The CVSS v3.1 base score is 9.6, reflecting critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability compromise.

An attacker on the management network can bypass authentication and gain full administrative control over IBM Power Systems managed by the vulnerable firmware versions. This includes the ability to control partition power states, modify system configurations, and access consoles for all hosted partitions. The impact affects confidentiality, integrity, and availability of the managed systems, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management network to trusted administrators only and monitor for unauthorized access attempts. Follow IBM's official guidance once published.