CVE-2026-4932This Power System update is being released to address Insufficient Entropy
- 4.2MediumCVSS base score
- 0.11%Exploitation in 30 daysEPSS · top 99% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.
Timeline
ID reserved
By ibm
- 4 months later
· 4 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ibmCNA (assigner) | 3.1 | Medium4.2 | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Medium4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.11% · top 99% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.2.
Affected products
- affected FW1110.00 – ≤ FW1110.20
- affected FW1060.00 – ≤ FW1060.71
What to do
Solution: Customers with the products below should install FW1110.30(1110_125), or newer and reboot the system to remediate this vulnerability. Power 11 * IBM Power System E1180 (9080-HEU) Customers with the products below should install FW1110.30(1110_145), or newer and reboot the system to remediate this vulnerability. Power 11 * IBM Power System S1122 (9824-22A) * IBM Power System S1124 (9824-42A) * IBM Power System S1122s (9824-22B) * IBM Power System S1114 (9824-41B) * IBM Power System L1122 (9856-22H) * IBM Power System L1124 (9856-42H) * IBM Power System E1150 (9043-MRU) Customers with the products below should install FW1060.72(1060_171)/FW1060.80(1060_180), or newer and reboot the system to remediate this vulnerability. Power 10 * IBM Power System E1080 (9080-HEX) Customers with the products below should install FW1060.72(1060_177)/FW1060.80(1060_185), or newer and reboot the system to remediate this vulnerability. Power 10 * IBM Power System S1022 (9105-22A) * IBM Power System S1024 (9105-42A) * IBM Power System S1022s (9105-22B) * IBM Power System S1014 (9105-41B) * IBM Power System L1022 (9786-22H) * IBM Power System L1024 (9786-42H) * IBM Power System E1050 (9043-MRX) * IBM Power System S1012 (9028-21B)
Workaround: NOTE: If performing a concurrent upgrade you must reboot the system after updating to the new firmware level to generate fresh TME encryption keys and mitigate this CVE
References
References1
- https://www.ibm.com/support/pages/node/7280632 (opens in a new tab)vendor-advisorypatch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-49954 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-4932)Record last updated .