{"id":"CVE-2026-12943","state":"PUBLISHED","title":"This Power Hardware Management Console update is being released to address","description":"IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.","publishedAt":"2026-07-30T17:57:46.718Z","updatedAt":"2026-07-31T03:56:18.697Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM HMC V10.3.1050.0","IBM HMC V11.1.1110.0"],"affected":[{"vendor":"IBM","product":"HMC V10.3.1050.0","versions":[{"version":"10.3.1050.0","status":"affected","lessThanOrEqual":"10.3.1064.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:hmc_v10310500:10.3.1050.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hmc_v10310500:10.3.1064.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"HMC V11.1.1110.0","versions":[{"version":"11.1.1110.0","status":"affected","lessThanOrEqual":"11.1.1112.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:hmc_v11111100:11.1.1110.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hmc_v11111100:11.1.1112.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7278667"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12943.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12943","state":"PUBLISHED","datePublished":"2026-07-30T17:57:46.718Z","dateUpdated":"2026-07-31T03:56:18.697Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-06-22T19:55:16.119Z"},"containers":{"cna":{"title":"This Power Hardware Management Console update is being released to address","descriptions":[{"lang":"en","value":"IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input."}],"affected":[{"vendor":"IBM","product":"HMC V10.3.1050.0","versions":[{"version":"10.3.1050.0","status":"affected","lessThanOrEqual":"10.3.1064.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:hmc_v10310500:10.3.1050.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hmc_v10310500:10.3.1064.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"HMC V11.1.1110.0","versions":[{"version":"11.1.1110.0","status":"affected","lessThanOrEqual":"11.1.1112.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:hmc_v11111100:11.1.1110.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hmc_v11111100:11.1.1112.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7278667","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-07-30T17:57:46.718Z"},"solutions":[{"lang":"en","value":"IBM strongly recommends addressing the vulnerability now. The following fixes are available on IBM Fix Central at:\n\n\n\nV10R3\n\n\n\n https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V10R3&platform=All \n\n\n\n https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V10R3&platform=All \n\n\n\nV11R1\n\n\n\n https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V11R1&platform=All \n\n\n\n https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V11R1&platform=All \n\n\n\n\n\n\n\n\n\nProduct\n\nAffected Version(s)\n\nVRMF\n\nAPAR\n\nRemediation/Fix\n\nPower HMC\n\nV10.3.1050.0 - V10.3.1064.0\n\nV10.3.1064.1 x86\n\n\n\nMB04527\n\n\n\nMF71762\n\nPower HMC\n\nV10.3.1050.0 - V10.3.1064.0\n\nV10.3.1064.1 ppc\n\n\n\nMB04528\n\n\n\nMF71763\n\nPower HMC\n\nV11.1.1110.0 - V11.1.1112.0\n\nV11.1.1112.1 x86\n\n\n\nMB04529\n\n\n\nMF71764 \n\n\n\n\n\nPower HMC\n\nV11.1.1110.0 - V11.1.1112.0\n\nV11.1.1112.1 ppc\n\nMB04530\n\nMF71765","supportingMedia":[{"type":"text/html","base64":false,"value":"

IBM strongly recommends addressing the vulnerability now. The following fixes are available on IBM Fix Central at:

V10R3

https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V10R3&platform=All

https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V10R3&platform=All

V11R1

https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~9100HMCppc&release=V11R1&platform=All

https://www.ibm.com/support/fixcentral/main/selectFixes?parent=powersysmgmntcouncil&product=ibm~hmc~vHMC&release=V11R1&platform=All

Product
Affected Version(s)
VRMF
APAR
Remediation/Fix
Power HMC
V10.3.1050.0 - V10.3.1064.0
V10.3.1064.1 x86

MB04527

MF71762

Power HMC
V10.3.1050.0 - V10.3.1064.0
V10.3.1064.1 ppc

MB04528

MF71763

Power HMC
V11.1.1110.0 - V11.1.1112.0
V11.1.1112.1 x86

MB04529

MF71764 

Power HMC
V11.1.1110.0 - V11.1.1112.0
V11.1.1112.1 ppc
MB04530

MF71765 

"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-30T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-12943"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-31T03:56:18.697Z"}}]}}}