CVE-2026-18821 is a high severity (CVSS 7.5) out-of-bounds write in IBM PowerVM partition firmware during network boot. An unauthenticated attacker on the same network can send a malformed packet and run code in the partition firmware. IBM fixes it with FW1120.01, FW1110.31, FW1060.81 and FW950.H3 or newer.
What's affected
IBM lists these Power Systems firmware levels as affected: FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80 and FW950.00 through FW950.H2. Fixed firmware depends on the system:
- Power 11 E1180 (9080-HEU): FW1110.31 (1110_134) or FW1120.01 (1120_167) or newer
- Power 11 S1122, S1124, S1122s, S1114, L1122, L1124 and E1150: FW1110.31 (1110_155) or FW1120.01 (1120_190) or newer
- Power 11 S1112: FW1120.01 (1120_190) or newer
- Power 10 E1080 (9080-HEX): FW1060.81 (1060_184) or newer
- Power 10 S1022, S1024, S1022s, S1014, L1022, L1024, E1050 and S1012: FW1060.81 (1060_191) or newer
- Power 9 S922, H922, S914, S924, H924, E950 and E980: FW950.H3 (950_230) or newer
IBM states that other partitions and the managed system are not affected, and that only partitions actively performing a network boot are. IBM lists no workaround.
How to check if you're exposed
From the HMC, list the firmware level of each managed system:
lslic -t sys -m <system-name>
The output shows the installed and activated levels. Compare them with the table above for your model. You can also see firmware levels in the HMC web interface under the system's properties.
Then list which partitions use network boot, for example through NIM, and which networks they boot on. Only those partitions are exposed, and only during the boot phase.
What to do now
- Collect the firmware level of every Power system from the HMC.
- Plan firmware updates to the fixed level for each model, using IBM Fix Central.
- Schedule the updates in a maintenance window, as firmware activation can need a restart.
- Until updated, keep network boot traffic on an isolated, trusted network segment.
- Prefer boot from disk or SAN for partitions that do not need network boot.
- Verify the activated level after the update and record it in your asset list.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. The partition firmware that handles the boot network stack parses a malformed packet incorrectly and writes outside its buffer. Code that runs at this stage runs before the operating system loads, so it can compromise everything that the partition loads afterward.
The scoring reflects that: a high attack complexity, an adjacent network position and no authentication, with a high impact. IBM is clear that the damage stays inside the partition that is booting. The risk is highest on networks where untrusted hosts share the boot segment. KEV status is false.
Quick check
Are other partitions on the same system at risk?
IBM says other partitions and the managed system are not affected. Only a partition performing a network boot is.
Is there a workaround?
IBM lists none. Keeping network boot on an isolated segment lowers exposure until you update.
Sources
Last reviewed: 18 October 2026.
