EUVD-2026-86006
GHSA-468w-j8gw-m9h2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network position to Power server
-
ExploitSend crafted request to hypervisor interface
-
ExecutionTrigger out-of-bounds read
-
ImpactReceive leaked sensitive memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to be on the same adjacent network segment as the affected IBM PowerVM Hypervisor (AV:A limits reach - not routable/internet-wide exploitation) and to reach a hypervisor firmware interface that processes the malformed input. No authentication (PR:N) or user interaction (UI:N) is needed per the vector. Affected firmware is limited to specific service-pack ranges within FW950/FW1060/FW1110/FW1120 on IBM Power servers; systems on patched levels or off these branches are not exposed. Impact is confined to limited information disclosure (C:L) with no code execution, data modification, or DoS. |
| Impact | This is a genuinely low-priority issue despite being network/adjacent-reachable. The IBM/NVD CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes an unauthenticated adjacent-network attacker triggering an out-of-bounds read in the PowerVM Hypervisor that leaks a limited amount of sensitive memory (C:L) with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is: no public exploit identified at time of analysis. The only aggravating signals are the low attack complexity and lack of required privileges; the mitigating signals are adjacent-only reach (AV:A, not full internet-facing AV:N), low-only confidentiality impact, and the fact that hypervisor firmware attack surface is not typically exposed to arbitrary attackers. Notably, this CVE's vector differs from sibling PowerVM firmware CVEs (CVE-2026-17504/17503) which were AV:L/PR:H - here it is adjacent and unauthenticated, which is worth verifying against IBM's advisory since hypervisor-level unauthenticated adjacent access is unusual. Net: a real but minor information-leak flaw, not an urgent priority. |
| Exploit ScenarioDerived | An attacker positioned on the same adjacent network segment as a PowerVM-managed IBM Power server sends a crafted request to a hypervisor-exposed interface, triggering an out-of-bounds read that returns adjacent memory contents. The disclosed bytes could contain limited sensitive firmware state. No public proof-of-concept exists, and the leak is bounded (C:L), so this would most likely serve as a reconnaissance aid rather than a standalone compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Limited information disclosure affects IBM PowerVM Hypervisor firmware on specific service-pack levels (FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3), where an out-of-bounds read can expose a small amount of adjacent memory content to an attacker. Rated CVSS 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw requires no authentication or user interaction but is not reachable across the internet: the attacker must already sit on the same adjacent network segment and be able to reach a hypervisor firmware interface that processes malformed input. Impact is confined to partial confidentiality loss with no integrity or availability effect, and no public exploit identified at time of analysis; IBM has published a vendor fix advisory.
RemediationAI
Patch available per vendor advisory: IBM has published a fix for this issue at https://www.ibm.com/support/pages/node/7289135, and the remediation is to upgrade PowerVM hypervisor firmware to the corrected service pack on each affected branch (FW950, FW1060, FW1110, FW1120). The data reviewed does not state the specific corrected build numbers, so confirm the target fix level on IBM's advisory before scheduling the update, and treat any system still within the ranges FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, or FW950.00-FW950.H3 as exposed. Plan for the operational cost of a firmware update, which typically requires a managed-system reboot or at minimum a planned maintenance window, and validate LPAR availability expectations before applying it. Where immediate patching is not possible, the only meaningful compensating controls target the AV:A precondition rather than the coding flaw: isolate the hypervisor management and firmware interfaces on a dedicated, tightly ACL-filtered VLAN and block adjacent-segment access from general-purpose user and workload networks, accepting that this reduces reach but does not eliminate the out-of-bounds read, plus monitor firmware and management-plane logs for unexpected interface traffic. Restricting segments can break legitimate administrative tooling and out-of-band management paths, so stage and test ACL changes before enforcing them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerVM is the firmware/hypervisor layer that partitions IBM Power servers into LPARs and mediates access to hardware resources, so the vulnerable component is vendor firmware rather than a user-space service. The root cause class is CWE-125 (out-of-bounds read): malformed input accepted by a firmware interface causes the parser to read beyond the bounds of an allocated buffer, returning adjacent memory contents to the caller rather than a bounded, intended value. Because the CVSS vector is AV:A with PR:N and UI:N, exploitation does not require credentials or victim interaction, but it is bounded by network proximity - the attacker must share an adjacent/L2 segment with the affected system and be able to reach the specific firmware interface that handles the input. The vector also shows S:U, C:L, I:N, A:N, meaning the disclosure stays within the hypervisor's security scope and is limited in volume, with no demonstrated path to code execution, privilege escalation, or denial of service. The CPE string cpe:2.3:a:ibm:powervm_hypervisor:*:*:*:*:*:*:*:* is a vendor-scoped wildcard that does not by itself enumerate patched versus unpatched builds, so version applicability must be resolved against the firmware branch ranges in IBM's advisory.
Know when Powervm Hypervisor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Agree with IBM: adjacent reach for a hypervisor firmware interface (AV:A), no auth or interaction, and an OOB read yielding only limited sensitive data (C:L, I:N, A:N).
Primary rating from Vendor (ibm).
CVSS VectorNVD
DescriptionNVD
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Powervm Hypervisor
View allAfter performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly conf
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boo
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its h
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and F
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authentic
IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 thro
IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.0
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) inter
Exploit-DB