{"id":"CVE-2026-16682","kind":"vulnerability","aliases":["CVE-2026-16682"],"related":[],"title":"IBM Power Systems firmware: uninitialized resource handling enables remote denial of service","description":"IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.","summary":"IBM Power Systems firmware versions across several FW1120, FW1110, FW1060, OP940 and OP910 ranges mishandle uninitialized resources. A remote attacker can cause a denial of service on affected systems.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firmware","ibm-power","infrastructure","power-systems"],"not_affected_if":["unknown"],"how_to_check":"- Identify the firmware level on each Power Systems server against the affected ranges listed in the description (for example `FW1110.31` or `OP910.95`)","fix":null,"status":"open","published_at":"2026-11-08T20:17:24+00:00","first_seen_at":"2026-11-08T20:22:46+00:00","triaged_at":"2026-11-08T20:23:34+00:00","updated_at":"2026-11-08T20:23:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-08T20:23:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Power Systems firmware: uninitialized resource handling enables remote denial of service","impact":"low","summary":"IBM Power Systems firmware versions across several FW1120, FW1110, FW1060, OP940 and OP910 ranges mishandle uninitialized resources. A remote attacker can cause a denial of service on affected systems.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-power","power-systems","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker crashes or disrupts the affected Power Systems server","analyst_note":"Confirm the fixed firmware versions and the triggering network service from IBM's security bulletin for CVE-2026-16682; NVD page only was provided.","how_to_check":"- Identify the firmware level on each Power Systems server against the affected ranges listed in the description (for example `FW1110.31` or `OP910.95`)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM Power Systems servers at the firmware ranges named in the description are exposed. The sources do not say which network services trigger the flaw or whether any configuration reduces exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4604,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16682':15A,18A '-2026':14A,17A 'across':32B 'affect':54B 'allow':80C 'attack':46B,83C 'caus':48B,85C 'could':79C 'cve':13A,16A 'denial':10A,50B,87C 'due':90C 'enabl':8A 'firmwar':4A,19B,30B,59C 'fw1060':36B 'fw1060.00':66C 'fw1060.81':68C 'fw1110':35B 'fw1110.00':63C 'fw1110.31':65C 'fw1120':34B 'fw1120.00':60C 'fw1120.01':62C 'handl':7A,93C 'ibm':1A,21B,27B,56C 'ibm-pow':20B 'improp':92C 'infrastructur':23B 'mishandl':41B 'op910':39B 'op910.00':72C 'op910.95':74C 'op940':37B 'op940.00':69C,76C 'op940.82':78C 'op940.a2':71C 'power':2A,22B,25B,28B,57C 'power-system':24B 'rang':40B 'remot':9A,45B,82C 'resourc':6A,43B,96C 'servic':12A,52B,89C 'sever':33B 'system':3A,26B,29B,55B,58C 'uniniti':5A,42B,95C 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Power Systems servers at the firmware ranges named in the description are exposed. The sources do not say which network services trigger the flaw or whether any configuration reduces exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firmware","ibmpower","infrastructure","medium","powersystems"],"campaign_type":null,"search_a":"'-16682':15A,18A '-2026':14A,17A 'cve':13A,16A 'denial':10A 'enabl':8A 'firmwar':4A 'handl':7A 'ibm':1A 'power':2A 'remot':9A 'resourc':6A 'servic':12A 'system':3A 'uniniti':5A","search_b":"'across':32B 'affect':54B 'attack':46B 'caus':48B 'denial':50B 'firmwar':19B,30B 'fw1060':36B 'fw1110':35B 'fw1120':34B 'ibm':21B,27B 'ibm-pow':20B 'infrastructur':23B 'mishandl':41B 'op910':39B 'op940':37B 'power':22B,25B,28B 'power-system':24B 'rang':40B 'remot':45B 'resourc':43B 'servic':52B 'sever':33B 'system':26B,29B,55B 'uniniti':42B 'version':31B","search_c":"'allow':80C 'attack':83C 'caus':85C 'could':79C 'denial':87C 'due':90C 'firmwar':59C 'fw1060.00':66C 'fw1060.81':68C 'fw1110.00':63C 'fw1110.31':65C 'fw1120.00':60C 'fw1120.01':62C 'handl':93C 'ibm':56C 'improp':92C 'op910.00':72C 'op910.95':74C 'op940.00':69C,76C 'op940.82':78C 'op940.a2':71C 'power':57C 'remot':82C 'resourc':96C 'servic':89C 'system':58C 'uniniti':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T20:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16682","severity":null,"published_at":"2026-11-08T20:17:24+00:00","modified_at":"2026-11-08T20:17:24+00:00","first_seen_at":"2026-11-08T20:22:46+00:00","fetched_at":"2026-11-08T20:22:46+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}