EUVD-2026-62870
GHSA-h5jm-cv9m-pvc4
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
Description explicitly requires guest root (PR:H); all other metrics match IBM's vector given local access, no complexity, and scope change to hypervisor.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.
AnalysisAI
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires root (superuser) access to a guest partition running on a vulnerable IBM PowerVM firmware version (FW950.00 through FW950.H2, FW1060.00 through FW1060.80, FW1110.00 through FW1110.30, or FW1120.00). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score with AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H conveys a meaningful real-world risk in multi-tenant POWER environments, particularly where guest partitions are administered by parties distinct from the platform operator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware fix identified in IBM's security advisory at https://www.ibm.com/support/pages/node/7283231. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PowerVM systems running firmware versions FW950 through FW1120 and assess which support production workloads or multi-tenant environments-these are highest priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-s
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today