CVE-2026-18849: IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process
31
Routine
MEDIUM 6.8UPGRADEUPGRADEUPGRADE
CVE-2026-18849 is a medium-severity flaw (CVSS 6.8) affecting openbmc, power system e1050 \(9043-mrx\) firmware, power system l1022 \(9786-22h\) firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.
Last updated 2026-09-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
Published CVE record published
Updated Record last modified
ibm openbmc UPGRADE
Affected: >= fw1060.00 and <= fw1060.80
Fixed in: newer than fw1060.80
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
ibm power system e1050 \(9043-mrx\) firmware UPGRADE
Affected: >= fw1060.00 and < fw1060.81
Fixed in: fw1060.81
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
ibm power system l1022 \(9786-22h\) firmware UPGRADE
Affected: >= fw1060.00 and < fw1060.81
Fixed in: fw1060.81
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
ibm power system l1024 \(9786-42h\) firmware UPGRADE
Affected: >= fw1060.00 and < fw1060.81
Fixed in: fw1060.81
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
ibm power system s1012 \(9028-21b\) firmware UPGRADE
Affected: >= fw1060.00 and < fw1060.81
Fixed in: fw1060.81
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
ibm power system s1014 \(9105-41b\) firmware UPGRADE
Affected: >= fw1060.00 and < fw1060.81
Fixed in: fw1060.81
Safe to downgrade to: a release before fw1060.00
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-18849?
openbmc: upgrade to newer than fw1060.80; power system e1050 \(9043-mrx\) firmware: upgrade to fw1060.81; power system l1022 \(9786-22h\) firmware: upgrade to fw1060.81. Exact commands for each OS are on this page.
Is CVE-2026-18849 being exploited?
CVE-2026-18849 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-18849 affect?
CVE-2026-18849 affects openbmc, power system e1050 \(9043-mrx\) firmware, power system l1022 \(9786-22h\) firmware. Severity is medium (CVSS 6.8). IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resultin
How urgent is CVE-2026-18849?
Priority 31/100. No elevated risk signals yet.
Related CVEs
CVE-2026-7254MEDIUM 5.3UPGRADE IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network
PatchTheCVE