CVE-2026-17503
This Power System update is being released to address
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
This Power System update is being released to address
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
- Record
CVE-2026-17503- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-85889
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
- Record
EUVD-2026-85889- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c8jr-2gj7-xxh3
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00...
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
- Record
GHSA-c8jr-2gj7-xxh3- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
- Record
CVE-2026-17503- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- ibm powervm hypervisor
- ibm power system e1050 \(9043-mrx\) firmware
- ibm power system e1080 \(9080-hex\) firmware
- ibm power system e1150 \(9043-mru\) firmware
- ibm power system e1180 \(9080-heu\) firmware
- ibm power system e950 \(9040-mr9\) firmware
- ibm power system e980 \(9080-m9s\) firmware
- ibm power system h922 \(9223-22s\) firmware
- ibm power system h924 \(9223-42s\) firmware
- ibm power system l1022 \(9786-22h\) firmware
- ibm power system l1024 \(9786-42h\) firmware
- ibm power system l1122 \(9856-22h\) firmware
Show 15 moreShow less
- ibm power system l1124 \(9856-42h\) firmware
- ibm power system s1012 \(9028-21b\) firmware
- ibm power system s1014 \(9105-41b\) firmware
- ibm power system s1022 \(9105-22a\) firmware
- ibm power system s1022s \(9105-22b\) firmware
- ibm power system s1024 \(9105-42a\) firmware
- ibm power system s1112 \(9242-21b\) firmware
- ibm power system s1112 \(9242-21t\) firmware
- ibm power system s1114 \(9824-41b\) firmware
- ibm power system s1122 \(9824-22a\) firmware
- ibm power system s1122s \(9824-22b\) firmware
- ibm power system s1124 \(9824-42a\) firmware
- ibm power system s914 \(9009-41g\) firmware
- ibm power system s922 \(9009-22g\) firmware
- ibm power system s924 \(9009-42g\) firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-17503 is a medium vulnerability (CVSS 5.1) in Ibm Powervm Hypervisor, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 1st percentile. No source names a fixed version.