IBM PowerVM Hypervisor CVE-2026-15961

Exploitation requires an attacker to already possess high-privilege local access to the IBM PowerVM system (PR:H per CVSS vector) - specifically administrative or equivalent control over hypervisor-level interfaces. High attack complexity (AC:H) imposes additional technical barriers, such as identifying the specific privileged input path that reaches the vulnerable format string handler. The vulnerability is strictly local (AV:L); network-based exploitation is not possible. Firmware must be within one of the affected release trains: FW1120.00, FW1110.00-FW1110.30, or FW1060.00-FW1060.80. The limiting factors - mandatory local presence, hypervisor-level privilege, and high complexity - restrict realistic exploitation to insider threat actors or attackers who have already fully compromised a privileged administrative account on the target POWER system.

The CVSS 5.2 Medium score is well-calibrated for this vulnerability. The vector AV:L/AC:H/PR:H/UI:N/S:U reflects significant prerequisites: local system access, high privilege (hypervisor-level administrator), and high attack complexity. The most operationally critical impact is A:H - a hypervisor crash would deny service to every virtual machine hosted on the affected POWER system, making this a high-severity event in production environments despite the moderate base score. Confidentiality (C:L) and integrity (I:L) impacts are present but limited by the format string context. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, indicating this is not being actively exploited at scale. The risk profile is highest for organizations running multi-tenant or critical workloads on IBM POWER where a privileged insider or compromised admin account could destabilize the entire host. For most environments this is a scheduled-maintenance patch priority rather than an emergency response.

A malicious or compromised administrator with high-privilege access to an IBM PowerVM system submits a crafted format string through a privileged hypervisor management interface or internal API, causing the firmware to process uncontrolled format specifiers. Depending on the code path reached, this could leak internal hypervisor memory (exposing cryptographic material or configuration secrets) or corrupt execution state, crashing the hypervisor and taking down all co-hosted virtual machines. No public proof-of-concept exists at time of analysis, and the AC:H requirement indicates that identifying the precise vulnerable input vector requires non-trivial technical expertise.