What is the CVSS score of CVE-2026-14971?

CVE-2026-14971 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PowerVM Novalink are affected by CVE-2026-14971?

IBM PowerVM Novalink API versions 2.2.0 through 2.3.2 contain a configuration flaw enabling low-privileged local attackers to obtain full control over virtualization infrastructure under non-default…

How to fix or mitigate CVE-2026-14971?

Within 24 hours, audit all IBM PowerVM Novalink API deployments to identify systems running versions 2.2.0-2.2.1.1 or 2.3.0-2.3.2, with specific documentation of which systems use non-default security configurations. Within 7 days, implement compensating controls by enforcing default security configurations on all affected systems, restricting local system access through OS-level access controls and network segmentation, and enabling comprehensive audit logging on PowerVM API operations. Within 30 days, establish monitoring for IBM security bulletins to detect patch availability and prepare a staged deployment plan prioritizing highest-risk systems.

PowerVM Novalink CVE-2026-14971

EUVD-2026-45302 HIGH

Configuration (CWE-16)

2026-07-17 psirt@us.ibm.com

GHSA-jgc9-pfqx-4x48

Authentication Bypass IBM Powervm Novalink

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector and low privilege reflect required local access under non-default config; AC:H captures the specific configuration prerequisites and exploitation complexity beyond simple access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 23:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 23:22 NVD

LOW HIGH

CVSS changed

Aug 11, 2026 - 23:22 NVD

3.9 (LOW) 7.0 (HIGH)

Analysis Generated

Jul 17, 2026 - 20:36 vuln.today

DescriptionNVD

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.

AnalysisAI

IBM PowerVM Novalink API misconfiguration (CWE-16) expands the attack surface and enables unauthorized virtualization management operations under non-default configurations. Versions 2.2.0 through 2.2.1.1 and 2.3.0 through 2.3.2 are confirmed affected via NVD CPE data, with a low-privileged local attacker potentially achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and an EPSS score of 0.10% at the 1st percentile signals negligible exploitation activity - real-world risk is constrained by the non-default configuration prerequisite and local-only attack vector.

Technical ContextAI

IBM PowerVM Novalink is a software-defined virtualization management layer for IBM POWER systems, exposing REST APIs for lifecycle management of logical partitions (LPARs) and PowerVM hypervisor resources. CWE-16 (Configuration) identifies the root cause as a configuration-level weakness rather than a code logic flaw - the API surface is broadened or improperly restricted under certain non-default deployments. The 'Authentication Bypass' tag associated with this CVE suggests the misconfigured API state may permit callers to invoke operations beyond their intended authorization boundary. Confirmed affected CPEs span cpe:2.3:a:ibm:powervm_novalink:2.2.0 through 2.2.1.1 and cpe:2.3:a:ibm:powervm_novalink:2.3.0 through 2.3.2, covering both active maintenance branches reported by IBM PSIRT.

RemediationAI

Consult the IBM security advisory at https://www.ibm.com/support/pages/node/7280225 for official patch guidance - a patch is available per vendor advisory, but no exact fixed version number is independently confirmed in the available data; verify the specific target version directly with IBM. As a compensating control, audit all IBM PowerVM Novalink API configuration settings and revert any non-default settings to hardened defaults, directly removing the prerequisite condition for exploitation. Restrict local system access to the POWER management host to only authorized administrators, reducing exposure from the local attack vector (AV:L). Enforce strict role-based access control and least-privilege principles for all users with local access to NovaLink hosts. Network segmentation of the management plane - isolating the NovaLink host from general-purpose internal networks - further reduces insider threat exposure without functional impact on normal LPAR operations.