IBM PowerVM Hypervisor CVE-2026-17414

Exploitation requires the attacker to be on the same network segment (adjacent network, AV:A) as a partition that is actively performing a network boot at the time of the attack - this is not a persistent exposure, only a window that exists during boot events. The more severe boot image substitution attack additionally requires that OS secure boot is NOT enabled on the target partition, which is the default configuration for IBM PowerVM. Limiting factors: the attack is bounded to the booting partition only - other partitions and the hypervisor managed system are explicitly unaffected; the attacker must maintain network adjacency (not routable from the general internet); and the opportunity is time-limited to active network boot operations. Enabling OS secure boot removes the image substitution vector entirely; network segmentation of boot traffic to a restricted VLAN eliminates the adjacency condition.

The CVSS 8.8 score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects serious impact potential when conditions are met, but the adjacent-network requirement substantially narrows the realistic exposure compared to internet-facing vulnerabilities. EPSS at 0.18% (8th percentile) and SSVC exploitation status of 'none' both confirm no observed in-the-wild exploitation at time of analysis, indicating this remains a theoretical risk despite the high CVSS. The gap between CVSS 8.8 and EPSS 0.18% is structurally explained: the attack window is narrow (only open during active network boot events) and requires precise network positioning, not a persistent exposure. The most operationally significant risk factor is that OS secure boot is disabled by default, placing the majority of production deployments in the configuration that permits full boot image substitution rather than mere denial-of-service. SSVC rating of automatable 'no' aligns with this narrow window. Defenders should weigh the high impact against the conditional exploitation path when prioritizing patching timelines.

An attacker pre-positioned on the same network segment as a Power Systems LPAR initiates a race against the legitimate PXE boot server when the target partition begins a network boot, responding first with a malicious boot image. Because OS secure boot is not enabled by default, the partition's firmware accepts and executes the attacker-supplied image, loading an attacker-controlled OS that grants full control over all workloads and data on that partition. No public exploit code has been identified, but the technique (PXE spoofing/race) is well-understood and requires only network adjacency.