IBM PowerVM EUVD-2026-85889

Requires the attacker to already possess ROOT (administrative) access inside a target logical partition of an IBM PowerVM-managed Power Systems server (PR:H, AV:L). The specific target is the partition firmware runtime boot configuration stored in partition nvram. Exploitation is limited to affected firmware levels: FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3. No user interaction is needed (UI:N), but there is no remote or unauthenticated path - the flaw is a post-compromise sabotage/persistence primitive against the attacker's own partition, and recovery requires operator intervention (deleting and recreating the partition config).

This is a genuinely low-to-moderate priority issue despite the MEDIUM 5.1 rating, and the CVSS vector itself is the strongest signal: AV:L (local), PR:H (high privilege), C:N, I:L, A:H. Exploitation requires the attacker to already hold ROOT access inside a partition - a very high bar that presupposes prior compromise. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - do not treat this as an active threat. No SSVC decision data was supplied. The impact is self-contained: an already-root attacker can persistently deny availability of the partition they control (integrity to the nvram/boot config, availability to the partition), recoverable only by an operator deleting and recreating the partition config. Note the vendor tag 'Information Disclosure' conflicts with the vector (C:N confirms NO confidentiality impact) - this is a mislabeled tag, not an info-disclosure bug. Net: real but narrow - a post-compromise persistence/sabotage primitive, not an initial-access or widely-exploitable flaw.

An attacker who has already gained root on a logical partition (LPAR) - for example via a separate OS-level compromise or a malicious insider administering that partition - writes malicious data to the partition's nvram boot configuration. On the next boot the partition fails to start and remains unbootable until a Power Systems operator manually deletes and recreates the partition configuration. No public exploit code is known.