CVE-2026-16678
4.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-772
Impact
An authenticated adjacent network attacker with high privileges can trigger a denial of service on the Power Systems server. They need valid high-privilege credentials and local network access to exhaust system connection resources.
Root cause
Improper resource management fails to release connection resources, leading to resource exhaustion (CWE-772).
Affected systems
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to fixed firmware levels above FW1110.31, FW1120.01, or FW1060.81 as detailed in IBM advisory node/7287270; if patching must wait, isolate management interfaces to trusted administrative subnets and restrict high-privilege administrative access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management.