Is CVE-2026-12943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12943 being exploited in the wild.

How severe is CVE-2026-12943?

Critical severity, with a CVSS score of 9.8, published 30 July 2026.

Which products and versions are affected?

IBM Hardware Management Console (HMC) 10.3.1050.0 - 10.3.1064.0; IBM Novalink Impacted versions within Power environments.

Is there a fix for CVE-2026-12943?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12943 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12943?

Check whether you run IBM Hardware Management Console (HMC) or IBM Novalink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12943: IBM Power HMC command injection in management systems

CVE-2026-12943 · Severity: critical · CVSS 9.8 · Published 2026-07-30

IBM Power Hardware Management Console (HMC), a tool used by administrators to manage IBM Power servers and virtual machines, contains a critical security flaw. An unauthenticated attacker could remotely take full control of the management system by exploiting improper input handling. This could lead to unauthorized access to managed server infrastructure, data theft, or complete service disruption.

Technologies: IBM Novalink. Vendors: IBM.

Quick answers

Is CVE-2026-12943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12943 being exploited in the wild.
How severe is CVE-2026-12943?: Critical severity, with a CVSS score of 9.8, published 30 July 2026.
Which products and versions are affected?: IBM Hardware Management Console (HMC) 10.3.1050.0 - 10.3.1064.0; IBM Novalink Impacted versions within Power environments.
Is there a fix for CVE-2026-12943?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12943 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12943?: Check whether you run IBM Hardware Management Console (HMC) or IBM Novalink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an OS Command Injection (CWE-78) within the IBM Power Hardware Management Console (HMC) and Novalink management systems. The flaw stems from improper neutralization of special elements in user-supplied input, allowing an unauthenticated attacker to inject and execute arbitrary commands via the network. Successful exploitation grants the attacker elevated privileges on the management system. IBM has released patches for affected versions V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0. Security updates are available via IBM Fix Central.

Affected products

IBM Hardware Management Console (HMC) V10 10.3.1050.0 - 10.3.1064.0
IBM Hardware Management Console (HMC) V11 11.1.1110.0 - 11.1.1112.0
IBM Novalink Impacted versions within Power environments

Timeline

2026-07-01: disclosed: Initial publication by IBM
2026-07-30: advisory: NVD publication date

References

https://www.ibm.com/support/pages/node/7278667

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.