What happened
A vulnerability identified as CVE-2026-16697 has been reported affecting certain versions of IBM Power Systems Firmware and IBM Power Hardware Management Console. The flaw arises from improper restriction of excessive computational resources, which could be exploited to cause a denial of service (DoS). The affected firmware versions for IBM Power Systems include FW1060.00 through FW1060.81, OP940.00 through OP940.A2, and OP910.00 through OP910.95. Additionally, the Power Hardware Management Console versions from OP940.00 to OP940.82 are impacted. Exploiting this vulnerability requires that an attacker have network access on the same local or logical network segment, with no prior access or user interaction necessary. The vulnerability has a severity rating of medium, with a CVSS base score of 6.5. The flaw exists within IBM OPENBMC and the Power Hardware Management Console, due to CWE-770, which pertains to improper restriction of excessive computational resources. The NVD reports that an attacker can cause high impact denial of service conditions by executing a sequence of remote actions without requiring privileges or user input. The vendor has not yet published specific patch information. Organisations running affected deployments should monitor vendor advisories for updates regarding fixed versions. As the scope may change during ongoing analysis, affected entities are advised to remain vigilant. Who is affected Organisations operating IBM Power Systems Firmware within the versions FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, or Power Hardware Management Console versions from OP940.00 to OP940.82 are potentially affected by this vulnerability. The impact is limited to situations where the affected software is reachable within the same local or logical network, with no user action needed to exploit the flaw. Due to the nature of the vulnerability, it could result in a denial of service affecting the stability and availability of the systems involved. Recommended actions
Apply updates once a vendor advisory is released specifying fixed software versions. Restrict network access to the affected components to trusted internal networks only. Monitor network traffic for unusual activity originating from the same local or logical network segment.
