Power System Out-of-bounds Read

published 2026-08-19 2 mo ago modified 2026-08-25 2 mo ago also EUVD-2026-62866

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.

Patch / fix

fixed in 20 links 1

ibm power_system_s1122_(9824-22a)_firmware fw1110.31
ibm power_system_s1124_(9824-42a)_firmware fw1110.31
ibm power_system_s1122s_(9824-22b)_firmware fw1110.31
ibm power_system_s1114_(9824-41b)_firmware fw1110.31
ibm power_system_l1122_(9856-22h)_firmware fw1110.31
ibm power_system_l1124_(9856-42h)_firmware fw1110.31
ibm power_system_e1150_(9043-mru)_firmware fw1110.31
ibm power_system_e1080_(9080-hex)_firmware fw1060.81
ibm power_system_s1022_(9105-22a)_firmware fw1060.81
ibm power_system_s1024_(9105-42a)_firmware fw1060.81
ibm power_system_s1022s_(9105-22b)_firmware fw1060.81
ibm power_system_s1014_(9105-41b)_firmware fw1060.81
ibm power_system_l1022_(9786-22h)_firmware fw1060.81
ibm power_system_l1024_(9786-42h)_firmware fw1060.81
ibm power_system_e1050_(9043-mrx)_firmware fw1060.81
ibm power_system_s1012_(9028-21b)_firmware fw1060.81
ibm power_system_e1180_(9080-heu)_firmware fw1110.31
ibm power_system_s922_(9009-22g)_firmware fw950.h3
ibm power_system_h922_(9223-22s)_firmware fw950.h3
ibm power_system_s914_(9009-41g)_firmware fw950.h3

ibm.com/support/pages/node/7283233 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-20)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

IBM PowerVM Hypervisor

Classification

Weakness

CWE-125 Out-of-bounds Read

References

ibm.com /support/pages/node/7283233
vendor-advisory, patch

Sources

CVE List CVE-2026-17028
NVD CVE-2026-17028

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary