Medium severity · published Aug 19, 2026
CVE-2026-17097
Power System Improper Validation
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PowerVM Hypervisor · IBM
FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; FW950.00 through FW950.H2 · source: vendor
PS
Power System E1050 (9043-mrx) Firmware · Ibm
fw1060.00 before fw1060.81 · source: NVD
PS
Power System E1080 (9080-hex) Firmware · Ibm
fw1060.00 before fw1060.81 · source: NVD
PS
Power System E1150 (9043-mru) Firmware · Ibm
fw1110.00 before fw1110.31; fw1120.00 · source: NVD
PS
Power System E1180 (9080-heu) Firmware · Ibm
fw1110.00 before fw1110.31; fw1120.00 · source: NVD
PS
Power System E950 (9040-mr9) Firmware · Ibm
fw950.00 before fw950.h3 · source: NVD
PS
Power System E980 (9080-m9s) Firmware · Ibm
fw950.00 before fw950.h3 · source: NVD
PS
Power System H922 (9223-22s) Firmware · Ibm
fw950.00 before fw950.h3 · source: NVD
PS
Power System H924 (9223-42s) Firmware · Ibm
fw950.00 before fw950.h3 · source: NVD
PS
Power System L1022 (9786-22h) Firmware · Ibm
fw1060.00 before fw1060.81 · source: NVD
PS
Power System L1024 (9786-42h) Firmware · Ibm
fw1060.00 before fw1060.81 · source: NVD
PS
Power System L1122 (9856-22h) Firmware · Ibm
fw1110.00 before fw1110.31; fw1120.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17097
Vendor Advisory
https://www.ibm.com/support/pages/node/7283231
More from PowerVM Hypervisor
9.6
CVE-2026-16687
Power System Buffer Overflow
9.6
CVE-2026-16835
Power System Improper Certificate Validation
8.8
CVE-2026-18821
Power System Out-of-bounds Write
8.8
CVE-2026-17414
Power System Improper Input Validation
8.4
CVE-2026-17091
Power System Integer Overflow
