CVE-2026-12943 This Power Hardware Management Console update is being released to address

What is CVE-2026-12943?

CVE-2026-12943 is a critical command injection vulnerability in IBM HMC V10.3.1050.0, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

Weakness: CWE-78

Which versions are affected by CVE-2026-12943?

It affects 1 product.

Products include Ibm Hardware Management Console.

How do I fix CVE-2026-12943?

No fix has been published for CVE-2026-12943 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-12943 being exploited?

There is no known exploitation of CVE-2026-12943 in the wild and no public exploit code.

Other vulnerabilities in IBM HMC V10.3.1050.0

• CVE-2009-0178 Other in n/a Critical 10.0
• CVE-2007-6293 Privilege escalation in n/a Critical 10.0
• CVE-2025-1950 IBM Hardware Management Console - Power Systems command execution Critical 9.3
• CVE-2009-1806 Other in n/a Critical 9.3
• CVE-2025-1951 IBM Hardware Management Console - Power Systems command execution High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hvmw-g754-cmg9.