Vulnerability · Published Aug 19, 2026 · Assigned by ibm

CVE-2026-16661Power System Integer Overflow

High 8.2

In plain English

A high-severity integer overflow in PowerVM Hypervisor from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 93.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.

Affected products (as reported)

Vendor	Product	Versions
IBM	PowerVM Hypervisor	FW1120.00FW1110.00 – through FW1110.30FW1060.00 – through FW1060.80FW950.00 – through FW950.H2

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://www.ibm.com/support/pages/node/7283237 vendor-advisory, patch