Powervm Novalink
Monthly
IBM PowerVM Novalink API misconfiguration (CWE-16) expands the attack surface and enables unauthorized virtualization management operations under non-default configurations. Versions 2.2.0 through 2.2.1.1 and 2.3.0 through 2.3.2 are confirmed affected via NVD CPE data, with a low-privileged local attacker potentially achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and an EPSS score of 0.10% at the 1st percentile signals negligible exploitation activity - real-world risk is constrained by the non-default configuration prerequisite and local-only attack vector.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.
IBM PowerVM Novalink API misconfiguration (CWE-16) expands the attack surface and enables unauthorized virtualization management operations under non-default configurations. Versions 2.2.0 through 2.2.1.1 and 2.3.0 through 2.3.2 are confirmed affected via NVD CPE data, with a low-privileged local attacker potentially achieving full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and an EPSS score of 0.10% at the 1st percentile signals negligible exploitation activity - real-world risk is constrained by the non-default configuration prerequisite and local-only attack vector.
Uncontrolled memory consumption in IBM PowerVM NovaLink lets a remote, unauthenticated attacker send a specially-crafted request that drives the server to exhaust memory resources, degrading or halting availability of the virtualization management layer. The CVSS 3.1 base score is 7.5 (High) with an availability-only impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and a vendor patch is available.