PowerVM Hypervisor CVE-2026-4937

Exploitation requires a local attacker who already holds administrative privileges on the IBM Power Systems host - the CVSS vector confirms AV:L and PR:H. The vulnerability is triggered through specific hypervisor API calls that request entropy, meaning the attacker must be able to invoke those calls, which is gated behind admin-level access. High attack complexity (AC:H) further implies that exploitation is not straightforward and likely requires specific conditions around call timing, sequencing, or system state. What limits exploitation: the local-only attack surface eliminates remote or network-based attackers entirely; the administrative privilege requirement means the vulnerability is relevant only after an attacker has already achieved a significant level of access; and high complexity means reliable exploitation is not trivial. No non-default configuration flag or optional feature toggle is described as a prerequisite - the flaw appears inherent to affected firmware versions when the relevant hypervisor calls are used.

The CVSS 5.3 Medium score is consistent with the attack prerequisites: local access (AV:L), high complexity (AC:H), and high privileges (PR:H) all substantially constrain who can exploit this. An attacker must already hold administrative privileges on the Power Systems host - a very high bar. However, the scope change (S:C) and high confidentiality impact (C:H) raise the consequence beyond what the base score alone implies: if exploited, an admin could potentially decrypt data belonging to guest partitions they should not have cryptographic access to, undermining hypervisor isolation guarantees. No EPSS data was supplied, and neither KEV listing nor public exploit code exists, aligning with a real-world risk that is meaningful in regulated, multi-tenant Power Systems environments (financial services, healthcare) but narrow in practical reach. The high complexity metric suggests that exploitation is not trivially repeatable and may require specific timing, call sequencing, or workload conditions.

A local attacker with hypervisor administrative rights on an IBM Power Systems host invokes the vulnerable hypervisor API calls in a crafted sequence, observing that returned entropy values are weaker than requested. The attacker uses this reduced-entropy output to reconstruct or narrow the keyspace of cryptographic material derived from those calls, ultimately decrypting data - potentially belonging to a co-resident guest partition - that the hypervisor's isolation model was intended to protect. No public proof-of-concept code has been identified, and the high complexity rating suggests meaningful engineering effort is required to operationalize the attack.