PowerVM Novalink CVE-2026-14971

Exploitation is explicitly conditioned on non-default IBM PowerVM Novalink API configuration - standard deployments with default settings are not affected per the vendor description. Limiting factors include: (1) local attack vector only (AV:L) - remote exploitation is not possible; (2) low privilege required (PR:L) - the attacker must already have authenticated local access to the NovaLink host; (3) high attack complexity (AC:H) - specific preconditions beyond just access and non-default configuration must align; (4) the non-default configuration prerequisite restricts impact to environments where Novalink APIs have been customized. The 'Authentication Bypass' tag suggests that under the non-default config, intended authorization checks may be circumvented, but this is inferred from tags and the CVSS PR:L metric, not explicitly confirmed in the description alone.

CVSS 3.1 scores this at 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - full CIA impact in scope, but gated behind a local attack vector, high attack complexity, and low-privilege authentication requirement. These constraints sharply limit the realistic attacker population. The EPSS score of 0.10% at the 1st percentile is consistent with no observed exploitation interest and effectively confirms no current exploitation trend. The vulnerability is not listed in the CISA KEV catalog. The description's explicit 'non-default conditions' qualifier is critical: standard PowerVM Novalink deployments are not exposed. Taken together, this is a high-CVSS-but-low-real-risk finding for organizations running default configurations; it becomes a genuine priority only for environments that have customized Novalink API settings and where insider or post-compromise local access is a credible threat model. CVSS impact metrics appear accurate, but the combination of AC:H and non-default configuration prerequisite means exploitation difficulty is materially higher than the base score alone implies.

A low-privileged local user on an IBM POWER virtualization host running a non-default Novalink API configuration could identify the expanded API attack surface and invoke API operations beyond their intended authorization. By bypassing intended access controls, the attacker could read sensitive LPAR configuration data, modify partition settings, or disrupt managed workloads - achieving full confidentiality, integrity, and availability impact within the virtualization management scope. No public exploit code has been identified, and the high attack complexity (AC:H) suggests exploitation would require specific environmental knowledge or timing.