Vulnerability · Published Aug 19, 2026 · Assigned by ibm
CVE-2026-17414Power System Improper Input Validation
High 8.1
In plain English
A high-severity improper input validation in PowerVM Hypervisor from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | PowerVM Hypervisor | FW1120.00FW1110.00 – through FW1110.30FW1060.00 – through FW1060.80FW950.00 – through FW950.H2 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://www.ibm.com/support/pages/node/7283234 vendor-advisory, patch