CVE-2026-16682: IBM Power Systems Firmware denial of service in BMC IPMI

CVE-2026-16682 · Severity: medium · CVSS 6.5 · Published 2026-11-08

IBM Power Systems include a management component (BMC) that monitors and controls server hardware over a network. An unauthenticated attacker on the network can crash the BMC's IPMI service, making the server unavailable until the BMC recovers. This disruption prevents administrators from managing the system during the outage.

Technologies: IBM Power Hardware Management Console. Vendors: IBM.

Quick answers

Is CVE-2026-16682 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16682 being exploited in the wild.
How severe is CVE-2026-16682?
Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?
IBM Power Hardware Management Console OP940.00–OP940.82; IBM Power Systems OpenBMC FW1120.00–FW1120.01, FW1110.00–FW1110.31, FW1060.00–FW1060.81, OP940.00–OP940.A2, OP910.00–OP910.95.
Is there a fix for CVE-2026-16682?
Yes: fixed in FW1120.02, FW1110.32, FW1060.82, OP940.A3, OP910.96, OP940.83. Until then: Restrict access to the BMC's network interface by operating it on a private network or behind a firewall to limit exposure to untrusted networks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16682 attacked?
It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-16682?
Check whether you run IBM Power Hardware Management Console or IBM Power Systems OpenBMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FW1120.02, FW1110.32, FW1060.82, OP940.A3, OP910.96, OP940.83

Restrict access to the BMC's network interface by operating it on a private network or behind a firewall to limit exposure to untrusted networks.

Technical details

The BMC's IPMI/RMCP+ network interface fails to properly initialize resources, allowing an unauthenticated remote attacker to cause a denial of service by sending crafted network traffic. The vulnerability (CWE-908: Use of Uninitialized Resource) crashes the IPMI service and places the BMC in a quiesced state. An adjacent network vector is required, though the CVSS vector indicates this is not a direct remote network attack.

Affected products

  • IBM Power Systems OpenBMC FW1120.00–FW1120.01, FW1110.00–FW1110.31, FW1060.00–FW1060.81, OP940.00–OP940.A2, OP910.00–OP910.95
  • IBM Power Hardware Management Console OP940.00–OP940.82

Timeline

  • 2026-10-28: disclosed: Initial publication of security bulletin

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.