EUVD-2026-62845
GHSA-wmfq-mfcf-jvxp
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
AV:A reflects management-plane adjacency; PR:H reflects required HMC or service processor admin credentials; AC:H reflects offline key derivation complexity; S:C because derived keys expose data outside the PKS/vTPM boundary.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
AnalysisAI
Platform KeyStore (PKS) and virtual TPM firmware in IBM PowerVM Hypervisor generate AES encryption keys from persistent storage seeds with insufficient entropy (CWE-331), reducing effective key strength below the intended security level. An adversary who already holds privileged access to the service processor or Hardware Management Console (HMC) can exploit this weakness to analytically derive the weakened AES key and decrypt data protected by those keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires simultaneous satisfaction of several concrete conditions: the attacker must have network adjacency to the IBM HMC or service processor management network (not reachable from general internet in a correctly segmented deployment), must possess high-privilege credentials on the HMC or service processor (PR:H), and user interaction is required per the CVSS vector (UI:R - likely an administrative action that triggers the vulnerable key generation or key-access operation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.1 (Medium) accurately reflects the layered exploitation prerequisites: adjacency requirement (AV:A), high attack complexity (AC:H), high privilege requirement (PR:H), and required user interaction (UI:R) must all be satisfied simultaneously, making opportunistic mass exploitation essentially infeasible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply vendor-supplied firmware updates documented in IBM advisory https://www.ibm.com/support/pages/node/7283890, which covers all three affected firmware branches (FW1110, FW1060, and FW950); exact patched build numbers must be confirmed directly from that advisory as they were not enumerated in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today