CVE-2026-18848

Published: Aug 19, 2026Modified: Aug 25, 2026

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Exploitability: 2.8 / Impact: 5.5

Source: psirt@us.ibm.com (Secondary)

Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

Affected (10)

Products: Ibm: Power System E1080 (9080 Hex) Firmware, Power System E1180 (9080 Heu) Firmware, Power System S922 (9009 22g) Firmware, Power System H922 (9223 22s) Firmware, Power System S914 (9009 41g) Firmware, Power System S924 (9009 42g) Firmware, Power System H924 (9223 42s) Firmware, Power System E950 (9040 Mr9) Firmware, Power System E980 (9080 M9s) Firmware

Ibm

9 products

Power System E1080 (9080 Hex) Firmware

Power System E1180 (9080 Heu) Firmware

Power System S922 (9009 22g) Firmware

Power System H922 (9223 22s) Firmware

Power System S914 (9009 41g) Firmware

Power System S924 (9009 42g) Firmware

Power System H924 (9223 42s) Firmware

Power System E950 (9040 Mr9) Firmware

Power System E980 (9080 M9s) Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System E1080 (9080 Hex) Firmware	From fw1060.00 to fw1060.81

Running on/with	Platform Versions
Ibm Power System E1080 (9080 Hex)	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System E1180 (9080 Heu) Firmware	From fw1110.00 to fw1110.31
Ibm Power System E1180 (9080 Heu) Firmware	Version fw1120.00

Running on/with	Platform Versions
Ibm Power System E1180 (9080 Heu)	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System S922 (9009 22g) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System S922 (9009 22g)	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System H922 (9223 22s) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System H922 (9223 22s)	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System S914 (9009 41g) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System S914 (9009 41g)	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System S924 (9009 42g) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System S924 (9009 42g)	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System H924 (9223 42s) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System H924 (9223 42s)	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System E950 (9040 Mr9) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System E950 (9040 Mr9)	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Power System E980 (9080 M9s) Firmware	From fw950.00 to fw950.h3

Running on/with	Platform Versions
Ibm Power System E980 (9080 M9s)	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://www.ibm.com/support/pages/node/7283897

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.