IBM PowerVM Hypervisor CVE-2026-17511

Requires authenticated administrator-level access to the Hardware Management Console (HMC) or the Power service processor and reachability to the management plane, then use of the partition resource dump interface on affected firmware (FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, FW950.00-FW950.H3). Exploitation is strongly limited by the PR:H requirement (management-plane administrator credentials) and adjacent-network access (AV:A), so it is not remotely reachable from general networks and not exploitable by unprivileged users; impact is confined to a limited read of partition processor state.

This is a genuinely low-priority issue and the low CVSS base score (3.4) is well justified by the vector. Exploitation requires PR:H (authenticated administrator-level access to the HMC or service processor) over an adjacent management network (AV:A), and the only impact is a partial confidentiality leak (C:L, I:N, A:N) - a limited snapshot of partition processor state. An attacker who already holds HMC/service-processor administrator credentials is a highly trusted, tightly scoped actor, so the incremental risk is small. There is no EPSS score, no CISA KEV listing, and no public exploit code, so all exploitation-likelihood signals are absent rather than conflicting. The IBM/NVD CVSS vector is internally consistent with the description (adjacent management-plane access, admin privilege, scope change from hypervisor to the managed partition). No data conflicts were identified; the main limitation is that only a single IBM support-page reference is available with no independent corroboration.

An attacker who has obtained administrator credentials for the HMC or the Power service processor invokes the partition resource dump interface to capture a limited snapshot of a managed partition's processor state, disclosing register/processor-context fragments that may contain sensitive runtime data. No public proof-of-concept or exploit code has been identified, and the adjacent-network, admin-privilege prerequisites make this a low-likelihood, insider- or post-compromise-style scenario.