This vulnerability (CVE-2026-17063) affects IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It arises from incorrect authorization controls in the interface between the Baseboard Management Controller/ Flexible Service Processor (BMC/FSP) and the host system. An attacker who has service account or root privileges on the BMC/FSP can access and disrupt the host processor state, potentially impacting the confidentiality and availability of the managed system and all hosted partitions. The CVSS 3.1 score is 7.9, reflecting high severity with local attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality and availability impacts but no integrity impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with elevated privileges on the BMC/FSP can disrupt host processor state, which may lead to confidentiality breaches and availability disruptions of the managed system and all hosted partitions. This can affect critical operations running on the IBM Power Systems Firmware, potentially causing system downtime or data exposure. The integrity of the system is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict and monitor access to the BMC/FSP interfaces to trusted administrators only, as exploitation requires service or root access to the BMC/FSP. Follow IBM's security advisories for updates on patches or mitigations.