CVE-2026-7868CWE-863broken-access-control

CVE-2026-7868

Medium · published July 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-28T20:20Z
Affected products (15)
ProductVersionsFixed in
ibm/power_system_s1122_\(9824-22a\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_s1124_\(9824-42a\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_s1122s_\(9824-22b\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_s1114_\(9824-41b\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_l1122_\(9856-22h\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_l1124_\(9856-42h\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_e1150_\(9043-mru\)_firmware≥ fw1110.00, < fw1110.30fw1110.30
ibm/power_system_s1022_\(9105-22a\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_s1024_\(9105-42a\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_s1022s_\(9105-22b\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_s1014_\(9105-41b\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_l1022_\(9786-22h\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_l1024_\(9786-42h\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_e1050_\(9043-mrx\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
ibm/power_system_s1012_\(9028-21b\)_firmware≥ fw1060.00, < fw1060.72fw1060.72
References (1)
https://www.ibm.com/support/pages/node/7280641 · [email protected]
EPSS history
Timeline
  • 28 JUL 15:59Z
    This Power System update is being released to address incorrect authorization
    cvelistv5