What is the CVSS score of CVE-2025-36238?

CVE-2025-36238 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Powervm Hypervisor are affected by CVE-2025-36238?

Organizations using sensitive information from a Virtual TPM should be aware of moderate risk from CVE-2025-36238 rated CVSS 6.0. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-36238?

Within 30 days: Identify affected systems running sensitive information from a Virtual TPM and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Powervm Hypervisor CVE-2025-36238

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-02-02 psirt@us.ibm.com

IBM Powervm Hypervisor

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 23:15 nvd

MEDIUM 6.0

DescriptionCVE.org

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

AnalysisAI

Powervm Hypervisor versions up to fw950.00 contains a vulnerability that allows attackers to a local user with administration privileges to obtain sensitive information from (CVSS 6.0).

Technical ContextAI

exists in the a series of PowerVM component. IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

RemediationAI

Monitor vendor advisories for a patch.

More in Powervm Hypervisor

View all

CVE-2022-34331 CRITICAL Act Now

9.8 Nov 11

After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf

CVE-2021-38917 CRITICAL Act Now

9.1 Dec 10

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and

CVE-2023-30438 HIGH This Week

8.8 May 17

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile

CVE-2023-30440 HIGH This Week

7.9 May 23

IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro

CVE-2023-25683 HIGH This Week

7.5 Jun 15

IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0

CVE-2022-22445 MEDIUM This Month

6.5 Jul 18

An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise pa

CVE-2021-38937 MEDIUM This Month

6.5 Dec 10

IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a s

CVE-2021-29795 MEDIUM This Month

6.0 Sep 21

IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of

CVE-2024-41781 MEDIUM This Month

5.9 Nov 22

IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00

CVE-2025-0986 MEDIUM This Month

4.5 Mar 28

IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certa

CVE-2021-20505 MEDIUM This Month

4.4 Jul 29

The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange

CVE-2025-36035 MEDIUM This Month

6.7 Sep 14

IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could all

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all

CVE-2026-34413 HIGH POC

8.8

CVE-2026-41459 MEDIUM POC

6.9

CVE-2022-1902 HIGH POC

8.8

CVE-2022-4985 HIGH POC

8.7

CVE-2018-25358 HIGH POC

8.7

CVE-2020-36922 HIGH POC

7.5

CVE-2020-36926 HIGH POC

7.5

CVE-2024-25634 MEDIUM POC

6.5

CVE-2025-36238 vulnerability details – vuln.today

Back

Powervm Hypervisor CVE-2025-36238

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Powervm Hypervisor

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

Share

External POC / Exploit Code