CVE-2026-18848

highpriority · track · 0EPSS 0.002 · 4 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 8.3 · high

Is it mine?

10 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

cvss

Technical severity, 0–10. One row per scoring source.

8.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:Hsecondary · psirt@us.ibm.com USexploitability 2.8 · impact 5.5

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-352US

affected products (10)

Products and version ranges known to be affected.

ibm power system e1080 (9080-hex) firmwarefw1060.00 → fw1060.81nvdUScpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:*
ibm power system e1180 (9080-heu) firmwarefw1110.00 → fw1110.31nvdUScpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*
ibm power system e1180 (9080-heu) firmware= fw1120.00nvdUScpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:*
ibm power system e950 (9040-mr9) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*
ibm power system e980 (9080-m9s) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*
ibm power system h922 (9223-22s) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*
ibm power system h924 (9223-42s) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*
ibm power system s914 (9009-41g) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*
ibm power system s922 (9009-22g) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*
ibm power system s924 (9009-42g) firmwarefw950.00 → fw950.h3nvdUScpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-08-19modified 2026-08-25

references (1) nvd

External citations — patches, advisories, analysis.

https://www.ibm.com/support/pages/node/7283897Vendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan