Skip to content
Fencer Vulns
medium 4.2

CVE-2026-4932 json

This Power System update is being released to address Insufficient Entropy

published 2026-07-28 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-49954

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.

Patch / fix

  • ibm power_system_s1122_(9824-22a)_firmware fw1110.30
  • ibm power_system_s1124_(9824-42a)_firmware fw1110.30
  • ibm power_system_s1122s_(9824-22b)_firmware fw1110.30
  • ibm power_system_s1114_(9824-41b)_firmware fw1110.30
  • ibm power_system_l1122_(9856-22h)_firmware fw1110.30
  • ibm power_system_l1124_(9856-42h)_firmware fw1110.30
  • ibm power_system_e1150_(9043-mru)_firmware fw1110.30
  • ibm power_system_s1022_(9105-22a)_firmware fw1060.72
  • ibm power_system_s1024_(9105-42a)_firmware fw1060.72
  • ibm power_system_s1022s_(9105-22b)_firmware fw1060.72
  • ibm power_system_s1014_(9105-41b)_firmware fw1060.72
  • ibm power_system_l1022_(9786-22h)_firmware fw1060.72
  • ibm power_system_l1024_(9786-42h)_firmware fw1060.72
  • ibm power_system_e1050_(9043-mrx)_firmware fw1060.72
  • ibm power_system_s1012_(9028-21b)_firmware fw1060.72
  • ibm power_system_e1180_(9080-heu)_firmware fw1110.30
  • ibm power_system_e1080_(9080-hex)_firmware fw1060.72

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • IBM PowerVM Hypervisor

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.