Cyber Resilience

CVE-2026-7254

Ibm Openbmc 1110.00 – 1110.11

Published
27 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0024 15th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-7254 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Ibm Openbmc. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.

CWE(s)
CWE-1284

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote DoS directly maps to application/system exploitation for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated network access to exploit the BMC service directly enables remote exploitation of a public-facing application.
attack.mitre.org →
T1499 Endpoint Denial of Service Impactconfidence: HIGH
The described vulnerability allows unauthenticated users to trigger denial of service, directly facilitating endpoint DoS.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-1352Same vendor: Ibm
CVE-2024-31916Same product: Ibm Openbmc
CVE-2024-35124Same product: Ibm Openbmc
CVE-2026-3676Same vendor: Ibm
CVE-2025-36094Same vendor: Ibm
CVE-2026-1577Same vendor: Ibm
CVE-2026-7771Same vendor: Ibm
CVE-2025-13867Same vendor: Ibm
CVE-2026-9002Same vendor: Ibm
CVE-2025-36015Same vendor: Ibm

Affected Assets

ibm
openbmc
1110.00 — 1110.11

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of input quantities, mitigating the CWE-1284 flaw that unauthenticated users exploit to trigger DoS.

SC-5 Denial-of-service Protection good match
prevent

Provides explicit denial-of-service protection mechanisms to limit the impact of network-based resource exhaustion attacks.

SC-7 Boundary Protection partial match
prevent

Restricts network traffic at system boundaries, reducing exposure of the vulnerable BMC interfaces to unauthenticated external actors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper quantity/length validation in input handling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect missing quantity validation but does not itself implement the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage robust input handling but do not specifically address quantity validation.

A.8.28 Secure coding partial match
prevents

Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.

References