IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
IBM HMC V10.3.1050.0 affected
Version Status Constraints
10.3.1050.0 affected ≤ 10.3.1064.0
IBM HMC V11.1.1110.0 affected
Version Status Constraints
11.1.1110.0 affected ≤ 11.1.1112.0

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
Hmc V10310500 Subscribe
Hmc V11111100 Subscribe
Advisories

No advisories yet.

Fixes

Solution

IBM strongly recommends addressing the vulnerability now. The following fixes are available on IBM Fix Central at: V10R3 https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V10R3&platform=All https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V10R3&platform=All V11R1 https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V11R1&platform=All https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V11R1&platform=All Product Affected Version(s) VRMF APAR Remediation/Fix Power HMC V10.3.1050.0 - V10.3.1064.0 V10.3.1064.1 x86 MB04527 MF71762 Power HMC V10.3.1050.0 - V10.3.1064.0 V10.3.1064.1 ppc MB04528 MF71763 Power HMC V11.1.1110.0 - V11.1.1112.0 V11.1.1112.1 x86 MB04529 MF71764  Power HMC V11.1.1110.0 - V11.1.1112.0 V11.1.1112.1 ppc MB04530 MF71765

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.ibm.com/support/pages/node/7278667 cve-icon
History

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Title This Power Hardware Management Console update is being released to address
First Time appeared Ibm
Ibm hmc V10310500
Ibm hmc V11111100
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:hmc_v10310500:10.3.1050.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v10310500:10.3.1064.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v11111100:11.1.1110.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:hmc_v11111100:11.1.1112.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm hmc V10310500
Ibm hmc V11111100
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-30T18:39:35.507Z

Reserved: 2026-06-22T19:55:16.119Z

Link: CVE-2026-12943

cve-icon Vulnrichment

Updated: 2026-07-30T18:39:31.353Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses