Quick answers
- Is CVE-2026-7254 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7254 being exploited in the wild.
- How severe is CVE-2026-7254?
- Informational severity, with a CVSS score of 5.3, published 27 May 2026.
- Which products and versions are affected?
- IBM OPENBMC FW1110 FW1110.00 through FW1110.11.
- Is there a fix for CVE-2026-7254?
- A patch was published on 2026-05-14: FW1110.20 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-7254 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-7254?
- Check whether you run IBM OPENBMC FW1110 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM OPENBMC firmware versions FW1110.00 through FW1110.11 contain a denial of service vulnerability in the HTTPS service. The root cause is identified as CWE-1284 (Improper Validation of Specified Quantity in Input), where the BMC fails to correctly validate input parameters. An unauthenticated attacker can exploit this over the network to disrupt the availability of the management interface. IBM has released firmware version FW1110.20 (1110_130) to address this issue. Affected hardware includes various IBM Power System models such as S1122, S1124, and E1150.
Affected products
- IBM OPENBMC FW1110 FW1110.00 through FW1110.11
Timeline
- 2026-05-14: advisory: Initial IBM security bulletin published
- 2026-05-14: patched: FW1110.20 released to address the vulnerability
- 2026-05-27: disclosed: CVE published to NVD