Description
IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. The following fixes are available on IBM Fix Central at: V10R3 https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V10R3&platform=All https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V10R3&platform=All V11R1 https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V11R1&platform=All https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V11R1&platform=All Product Affected Version(s) VRMF APAR Remediation/Fix Power HMC V10.3.1050.0 - V10.3.1064.0 V10.3.1064.1 x86 MB04527 MF71762 Power HMC V10.3.1050.0 - V10.3.1064.0 V10.3.1064.1 ppc MB04528 MF71763 Power HMC V11.1.1110.0 - V11.1.1112.0 V11.1.1112.1 x86 MB04529 MF71764  Power HMC V11.1.1110.0 - V11.1.1112.0 V11.1.1112.1 ppc MB04530 MF71765

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Title This Power Hardware Management Console update is being released to address
First Time appeared Ibm
Ibm hmc V10310500
Ibm hmc V11111100
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:hmc_v10310500:10.3.1050.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v10310500:10.3.1064.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v11111100:11.1.1110.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v11111100:11.1.1112.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm hmc V10310500
Ibm hmc V11111100
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Hmc V10310500 Hmc V11111100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-30T18:39:35.507Z

Reserved: 2026-06-22T19:55:16.119Z

Link: CVE-2026-12943

cve-icon Vulnrichment

Updated: 2026-07-30T18:39:31.353Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses