Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV A L N N U H H H 8.8 .0020 8.4 —
AFFECTED Product Versions Fixed PowerVM Hypervisor FW1120.00 – —
TIMELINE Aug 4 Reserved by ibm Aug 19 Published (CNA: ibm) Aug 25 RESCORED — CVE-2026-18821 (IBM PowerVM Hypervisor). CVSS 7.5 → 8.8 (NVD).
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
| Date | Event | Detail |
|---|---|---|
| August 4, 2026 | Reserved | Reserved by ibm |
| August 19, 2026 | Published | Published (CNA: ibm) |
| August 25, 2026 | RESCORED | RESCORED — CVE-2026-18821 (IBM PowerVM Hypervisor). CVSS 7.5 → 8.8 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| IBM | PowerVM Hypervisor | — | FW1120.00 | — |
Authoritative record: CVE-2026-18821 at cve.org
Vendors: ibm
Weaknesses: CWE-787
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-18821 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
