CVE-2026-93306 is an out-of-bounds read vulnerability (CWE-125) in the ASMI web interface of IBM Server Firmware across multiple version ranges. An unauthenticated attacker with network access to the management interface can send malformed HTTPS requests that crash the web server and may cause memory corruption. The ASMI interface automatically restarts after a crash, but repeated exploitation could lead to prolonged denial of management access, affecting system integrity and availability. No confidentiality impact is indicated. The CVSS 3.1 base score is 7.1, reflecting high severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

The vulnerability allows an unauthenticated attacker on the management network to cause the ASMI web server to crash, potentially corrupt memory, and generate error logs. While the interface restarts automatically, repeated exploitation can cause sustained loss of management interface access, impacting system integrity and availability. There is no impact on confidentiality.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. In the meantime, restrict access to the ASMI management network to trusted administrators only to reduce exposure. Monitor for unusual ASMI interface restarts and error logs indicative of exploitation attempts.