CVE-2026-16707

🗓️ 19 Aug 2026 20:09:07Reported by ibmType

PowerVM Hypervisor mailbox interface allows authenticated FSP access to read or modify Hostboot memory, compromising the boot stack and hypervisor.

Reporter	Title	Published	Views	Family All 7
IBM Security Bulletins	Security Bulletin: This Power System update is being released to address CVE-2026-16707	15 Aug 202617:26	–	ibm
Circl	CVE-2026-16707	28 Aug 202615:37	–	circl
Cvelist	CVE-2026-16707 Power System Out-of-bounds Read	19 Aug 202620:09	–	cvelist
EUVD	EUVD-2026-62840	19 Aug 202620:09	–	euvd
NVD	CVE-2026-16707	19 Aug 202620:17	–	nvd
Positive Technologies	PT-2026-78657	19 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-16707 Power System Out-of-bounds Read	19 Aug 202620:09	–	vulnrichment

NVD

Vulners

Node

AND

ibm power_system_s1122_(9824-22a)_firmwareRangefw1110.00–fw1110.31

ibm power_system_s1122_(9824-22a)_firmwareMatchfw1120.00

ibm power_system_s1122_(9824-22a)Match-

Node

AND

ibm power_system_s1124_(9824-42a)_firmwareRangefw1110.00–fw1110.31

ibm power_system_s1124_(9824-42a)_firmwareMatchfw1120.00

ibm power_system_s1124_(9824-42a)Match-

Node

AND

ibm power_system_s1122s_(9824-22b)_firmwareRangefw1110.00–fw1110.31

ibm power_system_s1122s_(9824-22b)_firmwareMatchfw1120.00

ibm power_system_s1122s_(9824-22b)Match-

Node

AND

ibm power_system_s1114_(9824-41b)_firmwareRangefw1110.00–fw1110.31

ibm power_system_s1114_(9824-41b)_firmwareMatchfw1120.00

ibm power_system_s1114_(9824-41b)Match-

Node

AND

ibm power_system_l1122_(9856-22h)_firmwareRangefw1110.00–fw1110.31

ibm power_system_l1122_(9856-22h)_firmwareMatchfw1120.00

ibm power_system_l1122_(9856-22h)Match-

Node

AND

ibm power_system_l1124_(9856-42h)_firmwareRangefw1110.00–fw1110.31

ibm power_system_l1124_(9856-42h)_firmwareMatchfw1120.00

ibm power_system_l1124_(9856-42h)Match-

Node

AND

ibm power_system_e1150_(9043-mru)_firmwareRangefw1110.00–fw1110.31

ibm power_system_e1150_(9043-mru)_firmwareMatchfw1120.00

ibm power_system_e1150_(9043-mru)Match-

Node

AND

ibm power_system_s1112_(9242-21b)_firmwareMatchfw1120.00

ibm power_system_s1112_(9242-21b)Match-

Node

AND

ibm power_system_s1112_(9242-21t)_firmwareMatchfw1120.00

ibm power_system_s1112_(9242-21t)Match-

Node

AND

ibm power_system_e1080_(9080-hex)_firmwareRangefw1060.00–fw1060.81

ibm power_system_e1080_(9080-hex)Match-

Node

AND

ibm power_system_s1022_(9105-22a)_firmwareRangefw1060.00–fw1060.81

ibm power_system_s1022_(9105-22a)Match-

Node

AND

ibm power_system_s1024_(9105-42a)_firmwareRangefw1060.00–fw1060.81

ibm power_system_s1024_(9105-42a)Match-

Node

AND

ibm power_system_s1022s_(9105-22b)_firmwareRangefw1060.00–fw1060.81

ibm power_system_s1022s_(9105-22b)Match-

Node

AND

ibm power_system_s1014_(9105-41b)_firmwareRangefw1060.00–fw1060.81

ibm power_system_s1014_(9105-41b)Match-

Node

AND

ibm power_system_l1022_(9786-22h)_firmwareRangefw1060.00–fw1060.81

ibm power_system_l1022_(9786-22h)Match-

Node

AND

ibm power_system_l1024_(9786-42h)_firmwareRangefw1060.00–fw1060.81

ibm power_system_l1024_(9786-42h)Match-

Node

AND

ibm power_system_e1050_(9043-mrx)_firmwareRangefw1060.00–fw1060.81

ibm power_system_e1050_(9043-mrx)Match-

Node

AND

ibm power_system_s1012_(9028-21b)_firmwareRangefw1060.00–fw1060.81

ibm power_system_s1012_(9028-21b)Match-

Node

AND

ibm power_system_e1180_(9080-heu)_firmwareRangefw1110.00–fw1110.31

ibm power_system_e1180_(9080-heu)_firmwareMatchfw1120.00

ibm power_system_e1180_(9080-heu)Match-

Node

AND

ibm power_system_s922_(9009-22g)_firmwareRangefw950.00–fw950.h3

ibm power_system_s922_(9009-22g)Match-

Node

AND

ibm power_system_h922_(9223-22s)_firmwareRangefw950.00–fw950.h3

ibm power_system_h922_(9223-22s)Match-

Node

AND

ibm power_system_s914_(9009-41g)_firmwareRangefw950.00–fw950.h3

ibm power_system_s914_(9009-41g)Match-

Node

AND

ibm power_system_s924_(9009-42g)_firmwareRangefw950.00–fw950.h3

ibm power_system_s924_(9009-42g)Match-

Node

AND

ibm power_system_h924_(9223-42s)_firmwareRangefw950.00–fw950.h3

ibm power_system_h924_(9223-42s)Match-

Node

AND

ibm power_system_e950_(9040-mr9)_firmwareRangefw950.00–fw950.h3

ibm power_system_e950_(9040-mr9)Match-

Node

AND

ibm power_system_e980_(9080-m9s)_firmwareRangefw950.00–fw950.h3

ibm power_system_e980_(9080-m9s)Match-

[
  {
    "vendor": "IBM",
    "product": "PowerVM Hypervisor",
    "versions": [
      {
        "status": "affected",
        "version": "FW1120.00"
      },
      {
        "status": "affected",
        "version": "FW1110.00",
        "lessThanOrEqual": "FW1110.30",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "FW1060.00",
        "lessThanOrEqual": "FW1060.80",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "FW950.00",
        "lessThanOrEqual": "FW950.H2",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:o:ibm:power_systems_firmware:fw1120.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw1110.30:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw1060.80:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7283235

25 Aug 2026 19:34Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.2

EPSS0.00132

SSVC

CWE-125