Security Bulletin: This Power System update is being released to address CVE-2026-17100

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control ove...

Security Bulletin: This Power System update is being released to address CVE-2026-18681

Summary Power Systems Firmware is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact...

Security Bulletin: This Power System update is being released to address CVE-2026-16828

Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory corruption and generate an error log; hosted partitions are not affected. The ASMI web interfa...

Security Bulletin: This Power System update is being released to address CVE-2026-18848

Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resultin...

Security Bulletin: This Power System update is being released to address CVE-2026-16938

Summary Power Systems Firmware is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain...

Security Bulletin: This Power System update is being released to address CVE-2026-16832

Summary Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity...

Security Bulletin: This Power System update is being released to address CVE-2026-16835

Summary Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state,...

Security Bulletin: This Power System update is being released to address CVE-2026-16687

Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentialit...

Security Bulletin: This Power System update is being released to address CVE-2026-18849

Summary Power Systems Firmware is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact...

Security Bulletin: This Power System update is being released to address CVE-2026-17028

Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and...

Security Bulletin: This Power System update is being released to address CVE-2026-18821

Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and...

Security Bulletin: This Power System update is being released to address CVE-2026-45447

Summary An authenticated administrator user uploading a specially crafted certificate to the FSP can lead to loss of integrity or remote code execution. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a...

MINI-33FX-RM26-F2R2

Bulletin has no description...

MINI-W65P-33V5-FX6V

Bulletin has no description...

MINI-F4FX-MX4R-2W4G

Bulletin has no description...

MINI-QC4R-M5WP-FWVR

Bulletin has no description...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...