Security Advisory

IBM Product Security Update Advisory

  • Aug 27 2026
IBM Product Security Update Advisory

Overview

Security updates addressing multiple vulnerabilities in IBM products have been released. The affected products are IBM webMethods Integration (on-premises), IBM Power HMC, WebSphere Application Server – Liberty, IBM Power Systems Firmware, IBM Portieris, IBM System Storage DS8A00, and IBM DS8900F.

Identified Vulnerabilities

  • CVE-2026-12118 is a remote code execution vulnerability in IBM webMethods Integration.
  • CVE-2026-12943 is a privilege escalation and arbitrary command execution vulnerability in IBM Power HMC.
  • CVE-2026-14525 is an authentication bypass vulnerability in WebSphere Application Server – Liberty.
  • CVE-2026-16930, CVE-2026-17494, and CVE-2026-19234 are arbitrary code execution vulnerabilities in IBM Power Systems Firmware.
  • CVE-2026-16933 is an arbitrary memory read and write vulnerability affecting IBM Power Systems Firmware.
  • CVE-2026-17063 is a vulnerability affecting access to and disruption of the host processor state in IBM Power Systems Firmware.
  • CVE-2026-17429 is an arbitrary write vulnerability in hardware control registers in IBM Power Systems firmware.
  • CVE-2026-18499 is a privilege escalation vulnerability in WebSphere Application Server – Liberty.
  • CVE-2026-18544 is an image policy bypass vulnerability in IBM Portieris.
  • CVE-2025-36254 is an authentication bypass vulnerability in IBM DS8A00 and IBM DS8900F HMC.
  • CVE-2025-36255 is a privilege escalation vulnerability in IBM DS8A00 and IBM DS8900F HMC.

Impact

A threat actor could exploit some of these vulnerabilities to perform arbitrary code execution, arbitrary command execution, bypassing authentication, or privilege escalation on the system. IBM has advised users of these products to update to the latest version or the corresponding patched version.

Patch Examples

  • IBM webMethods Integration (on-prem) is addressed by Integration Server Unit Test Framework 10.15 Fix 3, webMethods Integration Test Suite Server 11.1 Fix 4, and webMethods Integration Test Suite Server 12.1 Fix 1.
  • IBM Power HMC is resolved with V10.3.1064.1 Or V11.1.1112.1.
  • WebSphere Application Server – Liberty is resolved with version 26.0.0.9 Or later, or with APAR DT496165 Interim Fix and APAR DT497580 Interim Fix.
  • IBM Power Systems Firmware: This issue is resolved with FW1060.81 Or later, FW1110.31 Or later, FW1120.01 Or later, OP940.A2 or later, OP940.82 Or later, or FW950.H3 or later.
  • IBM Portieris is resolved with version 0.14.3.
  • IBM System Storage DS8A00 is resolved with Microcode Bundle 10.11.34.1 Or 10.12.39.0.
  • The IBM DS8900F is resolved with Microcode Bundle 89.44.17.1, 89.44.25.1, 89.44.26.0, Or 89.45.10.0.

Tags:
Previous Post

Next Post