IBM PowerVM Hypervisor CVE-2026-17028

Exploitation requires adjacent-network access (Layer 2 or routed adjacency) to the network segment carrying the target partition's iSCSI SAN boot traffic - the CVSS AV:A vector confirms this is not remotely exploitable from arbitrary internet positions. The target partition must be actively and currently performing an iSCSI SAN network boot; partitions using local disk boot, VIOS virtual SCSI, or any other boot method are not affected, nor are already-booted partitions. No authentication is required (PR:N confirmed by CVSS vector). The vulnerability scope is explicitly limited to the single actively booting partition - other logical partitions and the managed POWER system itself are unaffected per the vendor description. The attack window is transient, bounded entirely by the duration of the iSCSI SAN boot process.

The CVSS 3.1 base score of 6.5 (Medium) accurately reflects the constrained real-world impact: the attack vector is adjacent-network only (AV:A), limiting exposure to attackers already positioned on the same network segment as the booting partition, and the impact is restricted entirely to availability of a single partition with no confidentiality or integrity consequences. The transient exploitation window - only during an active iSCSI SAN network boot - further reduces practical risk, since this condition exists only during boot cycles rather than continuously. No EPSS data was supplied, no public exploit code has been observed, and the vulnerability is absent from the CISA KEV catalog, all of which reinforce that this remains a theoretical rather than actively exploited risk; even a mid-sized infrastructure team in zabrze running IBM POWER workloads for critical business services should weigh this against their iSCSI boot cycle frequency and network segmentation posture before prioritizing it above higher-CVSS, internet-reachable vulnerabilities. One signal worth flagging is the discrepancy between the formally assigned CWE-125 (Out-of-bounds Read) and the vendor tag listing 'Buffer Overflow' - these map to different vulnerability classes and the precise root cause is unconfirmed from public data alone. Overall, this is a low-complexity, adjacent-only DoS with a narrow transient attack window and no observed exploitation.

An attacker positioned on the same network segment as an IBM POWER partition actively cycling through an iSCSI SAN network boot sends crafted or malformed packets toward the booting partition's firmware boot stack. The partition firmware encounters an out-of-bounds read condition when processing the unexpected data, causing the boot sequence to fault and the partition to fail initialization. The affected partition remains offline until an operator intervenes, with no collateral impact to neighboring partitions or the managed POWER system.