CVE-2026-17414 affects partition firmware in IBM PowerVM on Power 9, Power 10 and Power 11 systems. An unauthenticated attacker on the same network as a partition doing a network boot can stop the boot, or substitute the boot image if OS secure boot is off. It scores 8.1, High. IBM has firmware fixes.
What's affected
Affected firmware levels, per IBM: FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The record lists these Power systems: E1050 (9043-MRX), E1080 (9080-HEX), E1150 (9043-MRU) and E1180 (9080-HEU), and IBM's bulletin names more models in its fix table.
IBM's fixed levels depend on the model:
- E1180 (9080-HEU): FW1110.31 (1110_134) or FW1120.01 (1120_167), or newer
- S1122, S1124, S1122s, S1114, L1122, L1124 and E1150: FW1110.31 (1110_155) or FW1120.01 (1120_190), or newer
- S1112: FW1120.01 (1120_190) or newer
- E1080: FW1060.81 (1060_184) or newer
- S1022, S1024, S1022s, S1014, L1022, L1024, E1050 and S1012: FW1060.81 (1060_191) or newer
- Power 9 (S922, H922, S914, S924, H924, E950, E980): FW950.H3 (950_230) or newer
IBM says the images are on Fix Central. It also says other partitions and the managed system are not affected: only partitions actively doing a network boot.
The record scores it 8.1 (High) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The vector is adjacent network, low complexity, no privileges, with high integrity and availability impact and no confidentiality impact. IBM's summary text mentions confidentiality, integrity and availability together, while the vector shows no confidentiality impact. We follow the vector.
How to check if you're exposed
Start with the firmware level of each managed system. Your HMC and ASMI both show the installed firmware level; compare it with the affected ranges above and the fixed level for your model.
Then decide whether the issue is relevant to how you operate. IBM says only partitions that are performing a network boot are affected. If your partitions boot from disk or SAN and never boot over the network, the exposure is much smaller. Check also whether OS secure boot is enabled on partitions that do network-boot. IBM says it is not enabled by default, and that without it the boot image could be swapped.
What to do now
- Collect the firmware level for every Power 9, Power 10 and Power 11 system under management.
- Find partitions that use network boot, for example for NIM installs or diskless setups, and note whether OS secure boot is on.
- Download the fixed firmware for your model from IBM Fix Central and plan the update with your usual firmware change process.
- Until the update, limit who can attach to the network segment used for network boot, and avoid network boots on shared segments.
- Where your operating system supports it, turn on OS secure boot for partitions that network-boot, since IBM says the image substitution risk applies where it is off.
- IBM lists no workaround.
Why it matters
The record classes the weakness as CWE-20, Improper Input Validation. Network boot works by a partition asking the network for a boot image and then running what it receives. If an attacker on the same segment can interfere with that conversation, two bad outcomes follow. They can stop the partition from finishing its boot, which is a denial of service. And where OS secure boot is not enabled, which is the default, they can replace the image, so everything that partition loads afterwards is theirs.
The record classes the cause as improper input validation in partition firmware. Because it sits in firmware below the operating system, patching the OS does not help. You need the firmware update, which usually means a planned change with an outage window.
The saving grace is scope. The attacker must be on the same network as the booting partition, only partitions mid-boot are exposed, and other partitions and the managed system are not affected, according to IBM. That makes network design the main control: keep boot networks private. The CVE is not reported as exploited and is not in the CISA catalog.
Quick check
Which partitions are exposed?
Only partitions that are performing a network boot, according to IBM. Other partitions and the managed system are not affected.
Does OS secure boot help?
IBM says that where OS secure boot is not enabled, the attacker can also substitute the boot image. Secure boot is off by default, so check it on partitions that boot over the network.
Sources
- IBM Security Bulletin 7283234: Power Systems firmware, fetched 18 October 2026
Last reviewed: 18 October 2026.
