EUVD-2026-62730
GHSA-xx9m-vc9m-c7wp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AV:L and PR:H confirmed by FSP service-level access requirement; S:C reflects firmware-to-host-runtime boundary crossing with full C/I/A impact on managed system.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.
AnalysisAI
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated service-level access to the IBM Flexible Service Processor (FSP) - a privileged management credential tier above standard HMC administrator access, typically held by IBM hardware support engineers or automation systems with explicit service-level authorization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects the high impact (C:H/I:H/A:H) and scope change but is partially moderated by the local attack vector (AV:L) and high privilege requirement (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released firmware patch per the IBM advisory at https://www.ibm.com/support/pages/node/7283237, which provides specific target fix levels for each affected firmware stream (FW950, FW1060, FW1110, FW1120). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Power systems running IBM PowerVM firmware versions FW950 through FW1120 and obtain the patched firmware versions from IBM. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-s
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today