CVE-2026-17093 is a stack-based buffer overflow vulnerability (CWE-121) in IBM Power Systems Firmware affecting multiple firmware versions across Power9 and Power HMC platforms. The flaw resides in the host firmware configuration parsing logic. An attacker with service-level privileges on the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) can supply specially crafted configuration data to trigger the overflow. This leads to compromise of the host firmware boot stage and all subsequently loaded components, resulting in a full compromise of confidentiality, integrity, and availability of the managed system. The CVSS v3.1 score is 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating a high severity vulnerability requiring high privileges but with significant impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Exploitation allows an attacker with service-level access to the BMC/FSP to compromise the host firmware boot stage, leading to complete control over the system's firmware execution. This results in a loss of confidentiality, integrity, and availability of the managed system, potentially allowing persistent and stealthy compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict service-level access to the BMC/FSP to trusted administrators only and monitor for unauthorized access attempts. Follow IBM's security advisories for updates on patches or mitigations.