CVE-2026-18857
LowCVSS 3.4Summary
IBM OPENBMC versions FW1120.00-FW1120.01, FW1110.00-FW1110.31, and FW1060.00-FW1060.81 are affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.
Risk Assessment
The vulnerability may lead to disruption of system management services and leakage of sensitive data from BMC memory, potentially affecting the integrity and availability of the infrastructure.
Recommendation
It is recommended to update OPENBMC to a patched version and monitor access to the BMC management interface.
Other vulnerabilities in IBM OPENBMC
See all- CVE-2026-18849Medium
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access can execute arbitrary code under specific conditions, impacting confidentiality, integrity, and availability.
- CVE-2026-8058Medium
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow a user to supply a password with a resource dump request, which is then stored in the BMC audit log where an admin user can see it.
- CVE-2026-7868Medium
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow ReadOnly users to escalate privileges and give themselves administrator privileges.
Original NVD description (English source)
IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS