CVE-2026-4937

Received Received - Intake

IBM PowerVM Hypervisor Weak Encryption Key Generation

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-4937

EUVD

EUVD-2026-62842

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	powervm_hypervisor	From FW1110.00 (inc) to FW1110.20 (inc)
ibm	powervm_hypervisor	From FW1060.00 (inc) to FW1060.71 (inc)
ibm	powervm_hypervisor	From FW950.00 (inc) to FW950.H2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-331	The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Attack-Flow Graph

Executive Summary

This vulnerability affects IBM PowerVM Hypervisor versions FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2. A local attacker with admin privileges could exploit it to decrypt encrypted data because certain hypervisor calls use less entropy than requested.

Impact Analysis

If exploited, this vulnerability could allow an attacker to decrypt sensitive encrypted data, potentially leading to unauthorized access to confidential information or system resources.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing encrypted data, resulting in potential legal and financial penalties.

Mitigation Strategies

Apply the latest firmware updates from IBM for PowerVM Hypervisor to versions FW1110.21 or later, FW1060.72 or later, and FW950.H3 or later to address the entropy issue in hypervisor calls.

Hi! I’m here to help you understand CVE-2026-4937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70