{"id":"CVE-2026-4932","aliases":["EUVD-2026-49954","GHSA-4hx2-qrcw-x8xr"],"status":"published","title":"This Power System update is being released to address Insufficient Entropy","description":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00112,"percentile":0.01386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-331"],"published":"2026-07-28T18:09:32Z","modified":"2026-10-23T23:10:00Z","products":[{"vendor":"ibm","product":"power_system_e1050_\\(9043-mrx\\)_firmware"},{"vendor":"ibm","product":"power_system_e1080_\\(9080-hex\\)_firmware"},{"vendor":"ibm","product":"power_system_e1150_\\(9043-mru\\)_firmware"},{"vendor":"ibm","product":"power_system_e1180_\\(9080-heu\\)_firmware"},{"vendor":"ibm","product":"power_system_l1022_\\(9786-22h\\)_firmware"},{"vendor":"ibm","product":"power_system_l1024_\\(9786-42h\\)_firmware"},{"vendor":"ibm","product":"power_system_l1122_\\(9856-22h\\)_firmware"},{"vendor":"ibm","product":"power_system_l1124_\\(9856-42h\\)_firmware"},{"vendor":"ibm","product":"power_system_s1012_\\(9028-21b\\)_firmware"},{"vendor":"ibm","product":"power_system_s1014_\\(9105-41b\\)_firmware"},{"vendor":"ibm","product":"power_system_s1022_\\(9105-22a\\)_firmware"},{"vendor":"ibm","product":"power_system_s1022s_\\(9105-22b\\)_firmware"},{"vendor":"ibm","product":"power_system_s1024_\\(9105-42a\\)_firmware"},{"vendor":"ibm","product":"power_system_s1114_\\(9824-41b\\)_firmware"},{"vendor":"ibm","product":"power_system_s1122_\\(9824-22a\\)_firmware"},{"vendor":"ibm","product":"power_system_s1122s_\\(9824-22b\\)_firmware"},{"vendor":"ibm","product":"power_system_s1124_\\(9824-42a\\)_firmware"},{"vendor":"ibm","product":"powervm hypervisor"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7280632","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4932"},{"url":"https://github.com/advisories/GHSA-4hx2-qrcw-x8xr"}],"sources":{"cve":[{"id":"CVE-2026-4932","title":"This Power System update is being released to address Insufficient Entropy","description":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.","status":"published","published":"2026-07-28T18:09:32.739Z","modified":"2026-07-28T18:46:57.145Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:19:59.369956Z"}],"euvd":[{"id":"EUVD-2026-49954","description":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.","status":"published","published":"2026-07-28T18:09:32Z","modified":"2026-07-28T18:46:57Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:30.949894Z"}],"ghsa":[{"id":"GHSA-4hx2-qrcw-x8xr","title":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow...","description":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.","status":"published","published":"2026-07-28T21:31:33Z","modified":"2026-07-28T21:31:39Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T15:09:53.141941Z"}],"nvd":[{"id":"CVE-2026-4932","description":"IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.","status":"published","published":"2026-07-28T19:17:36.287Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:12:33.249634Z"}]}}