CVE-2026-18681 is a stack-based buffer overflow vulnerability in IBM Server Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The flaw exists in the FSP firmware update process and allows an attacker with authenticated administrator-level access to the FSP to execute arbitrary code under specific conditions. This can lead to a full compromise of confidentiality, integrity, and availability of the affected system components. The vulnerability is rated medium severity with a CVSS score of 6.8. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows arbitrary code execution by an attacker with authenticated administrator-level access to the FSP, resulting in potential compromise of confidentiality, integrity, and availability of the affected IBM server firmware components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to the FSP firmware update process to trusted personnel only and monitor for suspicious activity related to firmware updates.