What is the CVSS score of CVE-2025-36238?

CVE-2025-36238 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Powervm Hypervisor are affected by CVE-2025-36238?

Organizations using sensitive information from a Virtual TPM should be aware of moderate risk from CVE-2025-36238 rated CVSS 6.0. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-36238?

Within 30 days: Identify affected systems running sensitive information from a Virtual TPM and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Powervm Hypervisor CVE-2025-36238

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-02-02 psirt@us.ibm.com

IBM Powervm Hypervisor

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 23:15 nvd

MEDIUM 6.0

DescriptionCVE.org

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

AnalysisAI

Powervm Hypervisor versions up to fw950.00 contains a vulnerability that allows attackers to a local user with administration privileges to obtain sensitive information from (CVSS 6.0).

Technical ContextAI

exists in the a series of PowerVM component. IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

RemediationAI

Monitor vendor advisories for a patch.

More in Powervm Hypervisor

View all

CVE-2022-34331 CRITICAL Act Now

9.8 Nov 11

After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf

CVE-2021-38917 CRITICAL Act Now

9.1 Dec 10

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and

CVE-2026-18821 HIGH This Week

8.8 Aug 19

Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo

CVE-2026-17414 HIGH This Week

8.8 Aug 19

Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an

CVE-2023-30438 HIGH This Week

8.8 May 17

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile

CVE-2026-17091 HIGH This Week

8.4 Aug 19

IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h

CVE-2026-11885 HIGH This Week

8.4 Jul 30

OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F

CVE-2026-16661 HIGH This Week

8.2 Aug 19

Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic

CVE-2023-30440 HIGH This Week

7.9 May 23

IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro

CVE-2023-25683 HIGH This Week

7.5 Jun 15

IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0

CVE-2026-18871 HIGH This Week

7.3 Aug 19

Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service

CVE-2026-17097 MEDIUM This Month

6.7 Aug 19

IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all

CVE-2026-34413 HIGH POC

8.8

CVE-2026-41459 MEDIUM POC

6.9

CVE-2022-1902 HIGH POC

8.8

CVE-2022-4985 HIGH POC

8.7

CVE-2018-25358 HIGH POC

8.7

CVE-2020-36922 HIGH POC

7.5

CVE-2020-36926 HIGH POC

7.5

CVE-2026-28698 CRITICAL

9.2

CVE-2025-36238 vulnerability details – vuln.today

Back

Powervm Hypervisor CVE-2025-36238

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Powervm Hypervisor

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

Share

External POC / Exploit Code