CVE-2026-12943CWE-78command-injection

CVE-2026-12943

Critical · published July 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00758 · 54.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-30T23:17Z
Affected products (2)
ProductVersionsFixed in
ibm/hardware_management_console≥ 10.3.1050.0, < 10.3.1064.110.3.1064.1
ibm/hardware_management_console≥ 11.1.1110.0, < 11.1.1112.111.1.1112.1
References (1)
https://www.ibm.com/support/pages/node/7278667 · [email protected]
EPSS history
Timeline
  • 30 JUL 17:57Z
    This Power Hardware Management Console update is being released to address
    cvelistv5