CVE-2026-18848
Power System Cross-Site Request Forgery (CSRF)
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Power System Cross-Site Request Forgery (CSRF)
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
- Record
CVE-2026-18848- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2026-62688
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
- Record
EUVD-2026-62688- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pghq-9pjf-cfhf
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80,...
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
- Record
GHSA-pghq-9pjf-cfhf- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.
- Record
CVE-2026-18848- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
- ibm power systems firmware
- ibm power system e1080 \(9080-hex\) firmware
- ibm power system e1180 \(9080-heu\) firmware
- ibm power system e950 \(9040-mr9\) firmware
- ibm power system e980 \(9080-m9s\) firmware
- ibm power system h922 \(9223-22s\) firmware
- ibm power system h924 \(9223-42s\) firmware
- ibm power system s914 \(9009-41g\) firmware
- ibm power system s922 \(9009-22g\) firmware
- ibm power system s924 \(9009-42g\) firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-18848 is a high vulnerability (CVSS 8.3) in Ibm Power Systems Firmware, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. No source names a fixed version.