IBM PowerVM Hypervisor EUVD-2026-62840

Exploitation requires authenticated service-level access to the FSP (Flexible Service Processor) - a privilege tier that is distinct from and more restricted than standard OS-level or hypervisor-level administrative access. FSP service-level credentials are used for hardware diagnostics, firmware updates, and low-level system management, and are not exposed by default to ordinary system administrators. The CVSS vector confirms AV:L (local/management-network access to the FSP interface) and PR:H (high privilege - FSP service-level authentication). Systems where the FSP management network is isolated from untrusted networks and where FSP service-level credentials are individually assigned, audited, and rotated are at substantially reduced risk. Exploitation is not possible by an attacker with only OS-level root access or standard PowerVM administrator access; FSP service-level credentials must be separately compromised. Non-default FSP access controls and proper network segmentation are the primary limiting factors.

The CVSS 8.2 score with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H accurately reflects the attack profile: local access vector (FSP management network), low complexity once credentials are obtained, and a high privilege prerequisite (FSP service-level authentication). The scope change to S:C is the key severity amplifier - exploiting the FSP mailbox to corrupt Hostboot memory enables hypervisor-level compromise, which in turn affects all guest workloads on the managed system. No EPSS score was provided, making quantitative exploitation probability unavailable. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, and no POC is identified, reducing near-term automated exploitation risk. Real-world risk is concentrated in environments where FSP service-level credentials are shared across teams, reused, or where FSP management networks are not properly segmented - scenarios common in large-scale IBM POWER deployments. This is not a mass-exploitation-class vulnerability due to the PR:H prerequisite; however, insider threats, supply-chain actors, or post-breach lateral movement targeting IBM infrastructure management planes represent credible threat actors. The combination of firmware-level impact and full CIA compromise means recovery from exploitation would require complete firmware re-provisioning, making this a high-consequence, lower-frequency risk.

An attacker who has obtained FSP service-level credentials - through credential theft from a shared service account, insider access, or compromise of an IBM management system - connects to the FSP management interface on a targeted POWER-series server. The attacker sends a specially crafted mailbox message designed to trigger an out-of-bounds read or write operation within Hostboot's memory space, corrupting the host firmware boot stack. On next system boot (or if the corruption affects live Hostboot memory), the hypervisor loaded from the tampered firmware inherits the compromise, granting the attacker persistent control over all virtual machines and workloads running on the managed system. No public POC has been identified, meaning this scenario currently requires knowledge of the FSP mailbox protocol internals.