EUVD-2026-62876
GHSA-3c3p-64wc-c8w7
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network attack during network boot (AV:A), no credentials needed (PR:N), scope unchanged as impact is explicitly limited to the single booting partition (S:U).
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target partition to be actively performing a network boot at the time of the attack - partitions in normal running state are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 High score reflects a genuinely serious exposure: adjacent-network, unauthenticated, no-interaction RCE with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch is available per IBM advisory at https://www.ibm.com/support/pages/node/7283232; administrators should apply the firmware update to move affected FW streams (FW950, FW1060, FW1110, FW1120) to the fixed levels specified in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all IBM Power Systems environments, identify which partitions have network boot enabled, and document current firmware versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter
Partition firmware in IBM PowerVM Hypervisor across firmware streams FW950 through FW1120 is vulnerable to a denial-of-s
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today