What is the CVSS score of CVE-2026-9171?

CVE-2026-9171 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Powervm Novalink are affected by CVE-2026-9171?

IBM PowerVM NovaLink faces a critical availability risk: remote, unauthenticated attackers can exploit a vulnerability to disable virtualization management services, impacting infrastructure…. A patch is available.

How to fix or mitigate CVE-2026-9171?

Within 24 hours, inventory all IBM PowerVM NovaLink deployments and verify current patch levels against the vendor advisory. Within 7 days, apply the vendor-released patch to all affected systems, prioritizing production virtualization environments, and test in a non-production environment beforehand to validate compatibility. Within 30 days, confirm patch deployment across all systems, monitor system logs for exploitation attempts, and validate that virtualization services are operating normally.

Powervm Novalink CVE-2026-9171

EUVD-2026-45250 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-17 ibm

GHSA-x8q4-qwvw-778r

Denial Of Service IBM Powervm Novalink

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:15 vuln.today

CVE Published

Jul 17, 2026 - 18:26 cve.org

HIGH 7.5

DescriptionCVE.org

IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

AnalysisAI

Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.