CVE-2026-14971

Received Received - Intake

IBM NovaLink API Misconfiguration Exposes Operations

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: IBM Corporation

Description

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-14971

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	powervm_novalink	2.2.02.2.12.2.1.1
ibm	powervm_novalink	2.3.02.3.0.12.3.12.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-16	Configuration

Attack-Flow Graph

Executive Summary

CVE-2026-14971 is a misconfiguration vulnerability in IBM PowerVM Novalink's NovaLink APIs. It allows unintended or unauthorized operations under non-default conditions, potentially increasing the attack surface for affected systems.

Detection Guidance

Check the installed version of IBM PowerVM Novalink using commands like 'rpm -qa | grep pvm-novalink' or 'apt list --installed | grep pvm-novalink' depending on your package manager. Compare the output against affected versions listed in the advisory.

Impact Analysis

This vulnerability could enable attackers to perform unauthorized actions on systems running vulnerable versions of IBM PowerVM Novalink. It may lead to data breaches, system compromise, or unauthorized access to sensitive resources if exploited.

Mitigation Strategies

Upgrade IBM PowerVM Novalink to the remediation versions pvm-novalink-2.2.1.1-260708 or pvm-novalink-2.3.3-260714 immediately. Follow IBM's official update instructions from the provided support page.

Hi! I’m here to help you understand CVE-2026-14971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70