IBM PowerVM Hypervisor CVE-2026-18821

Exploitation requires the target partition to be actively performing a network boot at the time of the attack - partitions in normal running state are not affected. The attacker must be on the same adjacent network segment as the booting partition (AV:A), meaning a physically co-located, same-VLAN, or same-broadcast-domain position is required; Internet-sourced attacks are not possible. No authentication or credentials are required (PR:N per CVSS). No user interaction is needed. Limiting factors: the attack window is transient and tied to the network boot phase only; other LPARs and the PowerVM managed system itself are explicitly out of scope. Non-default condition: network boot must be the configured boot method for the targeted partition.

The CVSS 8.8 High score reflects a genuinely serious exposure: adjacent-network, unauthenticated, no-interaction RCE with full confidentiality, integrity, and availability impact. However, multiple signals substantially bound real-world risk. First, the attack window is narrow - only partitions actively in the process of network booting are vulnerable, limiting exposure to a brief, scheduled operational event rather than a persistent attack surface. Second, EPSS stands at 0.19% (9th percentile), reflecting very low observed exploitation probability. Third, SSVC classifies exploitation as none and automatable as no, reinforcing that this has not been operationalized into opportunistic attacks. Fourth, scope is unchanged (S:U): the vendor explicitly states other partitions and the managed hypervisor are not affected, limiting blast radius to a single LPAR. The net assessment is a high-severity but narrow-window vulnerability - prioritize patching in environments where partitions regularly perform network boots, particularly in adversarial or multi-tenant network segments.

An attacker with access to the same network segment as an IBM Power Systems environment waits for or observes a partition initiating a network boot - a routine event during LPAR provisioning or recovery. The attacker sends a specially crafted malformed packet during the boot sequence, triggering an out-of-bounds write in the partition firmware's boot packet handler. No public exploit code has been identified, but the CWE-787 class is well-understood and the primitive (firmware-level code execution) would fully compromise the partition's boot chain, enabling persistent implantation in anything the partition loads.