CVE-2026-4937

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.

Score

CVSS 3.1 6.0 Medium

Status

Analyzed - psirt@us.ibm.com

Published

2026-08-19

Last modified

2026-08-20

Weaknesses

CWE-331

Affected products

• Power System E1050 (9043-mrx) Firmware (Ibm)
• Power System E1080 (9080-hex) Firmware (Ibm)
• Power System E1150 (9043-mru) Firmware (Ibm)
• Power System E1180 (9080-heu) Firmware (Ibm)
• Power System E950 (9040-mr9) Firmware (Ibm)
• Power System E980 (9080-m9s) Firmware (Ibm)
• Power System H922 (9223-22s) Firmware (Ibm)
• Power System H924 (9223-42s) Firmware (Ibm)
• Power System L1022 (9786-22h) Firmware (Ibm)
• Power System L1024 (9786-42h) Firmware (Ibm)
• Power System L1122 (9856-22h) Firmware (Ibm)
• Power System L1124 (9856-42h) Firmware (Ibm)
• Power System S1012 (9028-21b) Firmware (Ibm)
• Power System S1014 (9105-41b) Firmware (Ibm)
• Power System S1022 (9105-22a) Firmware (Ibm)
• Power System S1022s (9105-22b) Firmware (Ibm)
• Power System S1024 (9105-42a) Firmware (Ibm)
• Power System S1114 (9824-41b) Firmware (Ibm)
• Power System S1122 (9824-22a) Firmware (Ibm)
• Power System S1122s (9824-22b) Firmware (Ibm)
• Power System S1124 (9824-42a) Firmware (Ibm)
• Power System S914 (9009-41g) Firmware (Ibm)
• Power System S922 (9009-22g) Firmware (Ibm)
• Power System S924 (9009-42g) Firmware (Ibm)
• Power Systems Firmware (Ibm)

References

• https://www.ibm.com/support/pages/node/7283900