IBM PowerVM Hypervisor CVE-2026-17413

Exploitation requires the attacker to already hold administrator-level (root) access inside an IBM Power logical partition (LPAR) and to send a specially crafted request across the RTAS (Run-Time Abstraction Services) firmware-to-OS interface to the partition firmware. It is local-only (no network vector) and needs no user interaction. What LIMITS it: the mandatory root privilege on a partition, the local access requirement, and containment - the crash affects only the attacker's own partition and cannot cascade to other partitions on the same managed system (S:U). Affected firmware is FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3.

This is a genuinely low-to-moderate real-world risk, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H, base 5.1) tells the whole story: exploitation requires LOCAL access (AV:L) and, critically, administrator/root privileges (PR:H) inside a logical partition, with impact limited to availability (A:H) and minor integrity (I:L), no confidentiality loss (C:N), and no scope change (S:U) - the description confirms other partitions on the same managed system are unaffected. There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so the correct exploitation status is: no public exploit identified at time of analysis. The high privilege requirement is the dominant risk-limiter - an attacker who already has root on an LPAR can crash only that same partition, which is largely a self-inflicted/insider or post-compromise DoS rather than a remotely weaponizable flaw. No SSVC decision framework data was provided. Bottom line: a legitimate hardening fix but not an urgent patch-now priority; prioritize behind any network-reachable or unauthenticated issues.

An attacker who has already obtained root on an IBM Power logical partition (e.g., a malicious insider, a rogue LPAR administrator, or an attacker who compromised the OS in that partition) crafts a malformed RTAS request to the underlying partition firmware. The improper array-index handling (CWE-129) causes that single partition to crash and become unavailable, while other partitions on the same managed system keep running. No public exploit code is identified in the available data, and the local + root prerequisite makes this a targeted, post-compromise DoS rather than a broad threat.