EUVD-2026-62866
GHSA-mfrr-w396-wx78
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent network only; no authentication required; impact is pure availability loss confined to the single actively booting partition.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.
AnalysisAI
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-service attack during iSCSI SAN network boot. An unauthenticated attacker with adjacent-network access can disrupt the boot sequence of a target partition, preventing it from completing initialization while leaving all other partitions and the managed POWER system entirely unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent-network access (Layer 2 or routed adjacency) to the network segment carrying the target partition's iSCSI SAN boot traffic - the CVSS AV:A vector confirms this is not remotely exploitable from arbitrary internet positions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (Medium) accurately reflects the constrained real-world impact: the attack vector is adjacent-network only (AV:A), limiting exposure to attackers already positioned on the same network segment as the booting partition, and the impact is restricted entirely to availability of a single partition with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory at https://www.ibm.com/support/pages/node/7283233; the exact patched firmware version for each affected stream (FW950, FW1060, FW1110, FW1120) must be confirmed through IBM Fix Central, as no specific fixed release version was disclosed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today