What is the CVSS score of CVE-2026-11885?

CVE-2026-11885 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM PowerVM are affected by CVE-2026-11885?

IBM PowerVM Hypervisor versions FW950, FW1060, and FW1110 contain a critical memory integrity flaw that allows low-privileged virtual machine guests to crash the shared hypervisor or corrupt system…. A patch is available.

How to fix or mitigate CVE-2026-11885?

Within 24 hours, identify all systems running IBM PowerVM Hypervisor and document which firmware versions (FW950, FW1060, FW1110) are deployed. Within 7 days, coordinate with your infrastructure team to apply the vendor-released patch to all affected hypervisors, prioritizing systems hosting production workloads; schedule patching during approved maintenance windows to minimize downtime. Within 30 days, complete patch deployment across all PowerVM instances and verify through firmware version audits that no affected versions remain in your environment.

IBM PowerVM CVE-2026-11885

EUVD-2026-51238 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-30 ibm

GHSA-f687-cr2f-7jv7

Buffer Overflow IBM Powervm Hypervisor

8.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

8.4 HIGH

Local hcall from inside a partition (AV:L) with a low-privileged OS account (PR:L) crosses the guest-to-hypervisor boundary (S:C), corrupting memory (I:H) and crashing the hypervisor (A:H); no disclosure (C:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:22 vuln.today

CVE Published

Jul 30, 2026 - 16:38 nvd

HIGH 8.4

DescriptionCVE.org

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory integrity.

AnalysisAI

OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.

Technical ContextAI

PowerVM is IBM's Power Systems hypervisor (PHYP) that partitions physical hardware into logical partitions (LPARs) and mediates privileged operations through hypervisor calls (hcalls) invoked by partition operating systems such as AIX, IBM i, and Linux on Power. The vulnerability is classified as CWE-120 (Classic Buffer Copy without Size Check, i.e. buffer overflow), meaning the hypervisor copies data supplied via a specific hcall path without adequately validating its length or bounds. The affected component is identified in CPE data as cpe:2.3:a:ibm:powervm_hypervisor, spanning firmware trains FW1110.00-FW1110.20, FW1060.00-FW1060.71, and FW950.00-FW950.H1. Overflowing an internal hypervisor buffer permits either a crash of the control layer or unauthorized modification of OS memory belonging to a partition.

RemediationAI

Apply the IBM-provided firmware fix referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7280628; Patch available per vendor advisory, so upgrade each affected system firmware train (FW950, FW1060, FW1110) to the corrected level published by IBM for that stream, following IBM's concurrent or disruptive firmware update guidance for your Power hardware. Because the fix is delivered as system firmware, schedule the update within a maintenance window and validate against IBM's compatibility notes for your server model before deployment. Until firmware can be applied, reduce exposure by limiting who can run workloads or obtain OS-level accounts inside partitions on shared hosts, avoid co-locating untrusted or internet-facing partitions with sensitive ones on the same physical frame, and tighten access to partitions that could originate the malicious hcall; note these are containment measures that reduce the pool of potential local actors but do not close the underlying hypervisor call path.