CVE-2026-7868
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow ReadOnly users to escalate privileges and give themselves administrator privileges.
Risk Assessment
Unauthorized privilege escalation could lead to full compromise of the BMC system, allowing an attacker to modify hardware configuration or steal data.
Recommendation
Update IBM OpenBMC to a version that fixes this vulnerability, or restrict access to the BMC interface to trusted users only.
Other vulnerabilities in IBM OpenBMC
See all- CVE-2026-18849Medium
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access can execute arbitrary code under specific conditions, impacting confidentiality, integrity, and availability.
- CVE-2026-8058Medium
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow a user to supply a password with a resource dump request, which is then stored in the BMC audit log where an admin user can see it.
Original NVD description (English source)
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.