CVE-2026-4936 (GCVE-0-2026-4936)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:14 – Updated: 2026-08-20 13:29
VLAI
EPSS
VEX
Title
Power System Insufficient Entropy
Summary
IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:28 UTC
CWE
- CWE-331 - Insufficient Entropy
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7283890 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| IBM | PowerVM Hypervisor |
Affected:
FW1110.00 , ≤ FW1110.20
(semver)
Affected: FW1060.00 , ≤ FW1060.71 (semver) Affected: FW950.00 , ≤ FW950.H2 (semver) cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:* cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:* cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4936",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:28:12.630911Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T13:29:02.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"
],
"product": "PowerVM Hypervisor",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.20",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.71",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW950.H2",
"status": "affected",
"version": "FW950.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.\u003c/p\u003e"
}
],
"value": "IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "CWE-331 Insufficient Entropy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:14:55.609Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7283890"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1180 (9080-HEU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1122 (9824-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1124 (9824-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1122s (9824-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1114 (9824-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1122 (9856-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1124 (9856-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1150 (9043-MRU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1112 (9242-21B, 9242-21T)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cbr/\u003eCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1080 (9080-HEX)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1022 (9105-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1024 (9105-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1022s (9105-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1014 (9105-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1022 (9786-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1024 (9786-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1050 (9043-MRX)\u003c/li\u003e\u003cli\u003eIBM Power System S1012 (9028-21B)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\u003cbr/\u003ePower 9\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S922 (9009-22G)\u003c/li\u003e\u003cli\u003eIBM Power System H922 (9223-22S)\u003c/li\u003e\u003cli\u003eIBM Power System S914 (9009-41G)\u003c/li\u003e\u003cli\u003eIBM Power System S924 (9009-42G)\u003c/li\u003e\u003cli\u003eIBM Power System H924 (9223-42S)\u003c/li\u003e\u003cli\u003eIBM Power System E950 (9040-MR9)\u003c/li\u003e\u003cli\u003eIBM Power System E980 (9080-M9S)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cem\u003eThe images mentioned above can be located at IBM Fix Central : \u003c/em\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003e\u003cem\u003ehttps://www.ibm.com/support/fixcentral/\u003c/em\u003e\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System E1180 (9080-HEU)\n\n\nCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System S1122 (9824-22A)\n * IBM Power System S1124 (9824-42A)\n * IBM Power System S1122s (9824-22B)\n * IBM Power System S1114 (9824-41B)\n * IBM Power System L1122 (9856-22H)\n * IBM Power System L1124 (9856-42H)\n * IBM Power System E1150 (9043-MRU)\n\n\nCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\n\n\n\nPower 11\n\n * IBM Power System S1112 (9242-21B, 9242-21T)\n\n\n\nCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System E1080 (9080-HEX)\n\n\nCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System S1022 (9105-22A)\n * IBM Power System S1024 (9105-42A)\n * IBM Power System S1022s (9105-22B)\n * IBM Power System S1014 (9105-41B)\n * IBM Power System L1022 (9786-22H)\n * IBM Power System L1024 (9786-42H)\n * IBM Power System E1050 (9043-MRX)\n * IBM Power System S1012 (9028-21B)\n\n\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\nPower 9\n\n * IBM Power System S922 (9009-22G)\n * IBM Power System H922 (9223-22S)\n * IBM Power System S914 (9009-41G)\n * IBM Power System S924 (9009-42G)\n * IBM Power System H924 (9223-42S)\n * IBM Power System E950 (9040-MR9)\n * IBM Power System E980 (9080-M9S)\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/"
}
],
"title": "Power System Insufficient Entropy",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFollowing successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\u003c/p\u003e\u003cp\u003eBefore issuing the resource dump, confirm all of the following:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe system is at runtime.\u003c/li\u003e\u003cli\u003eThere are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).\u003c/li\u003e\u003cli\u003eThere are no unresolved action-required PEL entries.\u003c/li\u003e\u003cli\u003eThe system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\u003c/p\u003e\u003cp\u003eHMC-attached systems : \u00a0\u003ca href=\"https://www.ibm.com/support/pages/node/667943\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/667943\u003c/a\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFSP-based standalone systems:\u003c/p\u003e\u003cul\u003e\u003cli\u003eLog onto the system ASM with admin credentials\u003c/li\u003e\u003cli\u003eNavigate to System Service Aids -\u0026gt; Resource Dump\u003c/li\u003e\u003cli\u003eInitiate the resource dump\n\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eBMC-based standalone systems:\u003c/p\u003e\u003cul\u003e\u003cli\u003eLog onto the system ASMi with admin credentials\u003c/li\u003e\u003cli\u003eNavigate to Logs and Services -\u0026gt; Dumps -\u0026gt; Select a dump -\u0026gt; Resource Dump\u003c/li\u003e\u003cli\u003eInitiate the resource dump:\n\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor \u003cstrong\u003eHMC managed systems,\u003c/strong\u003e after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\u003c/p\u003e\u003cp\u003eTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHMC CLI (SSH):\u00a0\u003cem\u003els -ltr\u00a0/dump/RSCDUMP.*\u003c/em\u003e\u003c/li\u003e\u003cli\u003eValidate the Serial Number and date of dump.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eOnce the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\u003c/p\u003e\u003cp\u003eFor \u003cstrong\u003estandalone servers\u003c/strong\u003e, the resource dump will be uploaded to the Operating System.\u003c/p\u003e\u003cul\u003e\u003cli\u003eLinux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0\u003cstrong\u003e/var/log/dump/\u003c/strong\u003e. A B7009021 would present as a permanent error in the PPC64 platform log file.\u003c/li\u003e\u003cli\u003eIBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0\u003cstrong\u003eMain Storage Dump Manager\u003c/strong\u003e in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\u003c/li\u003e\u003cli\u003eAIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0\u003cstrong\u003e/var/adm/ras/platform/\u003c/strong\u003e. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eLastly:\u003c/strong\u003e Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.\u003c/p\u003e"
}
],
"value": "Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\n\n\n\nBefore issuing the resource dump, confirm all of the following:\n\n * The system is at runtime.\n * There are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).\n * There are no unresolved action-required PEL entries.\n * The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\n\n\n\n\nThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\n\n\n\nHMC-attached systems : \u00a0 https://www.ibm.com/support/pages/node/667943 \n\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\nFSP-based standalone systems:\n\n * Log onto the system ASM with admin credentials\n * Navigate to System Service Aids -\u003e Resource Dump\n * Initiate the resource dump\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nBMC-based standalone systems:\n\n * Log onto the system ASMi with admin credentials\n * Navigate to Logs and Services -\u003e Dumps -\u003e Select a dump -\u003e Resource Dump\n * Initiate the resource dump:\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nFor HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\n\n\n\nTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\n\n * HMC CLI (SSH):\u00a0ls -ltr\u00a0/dump/RSCDUMP.*\n * Validate the Serial Number and date of dump.\n\n\n\n\nOnce the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\n\n\n\nFor standalone servers, the resource dump will be uploaded to the Operating System.\n\n * Linux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.\n * IBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\n * AIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021\n\n\n\n\nLastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-4936",
"datePublished": "2026-08-19T20:14:55.609Z",
"dateReserved": "2026-03-26T20:32:20.576Z",
"dateUpdated": "2026-08-20T13:29:02.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-4936",
"date": "2026-08-26",
"epss": "0.00074",
"percentile": "0.00077"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-4936\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-08-19T21:16:55.353\",\"lastModified\":\"2026-08-25T20:36:34.443\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"PowerVM Hypervisor\",\"cpes\":[\"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*\",\"cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"FW1110.00\",\"lessThanOrEqual\":\"FW1110.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"FW1060.00\",\"lessThanOrEqual\":\"FW1060.71\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"FW950.00\",\"lessThanOrEqual\":\"FW950.H2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.7,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T13:28:12.630911Z\",\"id\":\"CVE-2026-4936\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-331\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122_\\\\(9824-22a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"A7446690-CECC-4F76-B2D6-9D6F5087771D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122_\\\\(9824-22a\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8707806-84E4-442B-A29F-7BF44514F8DA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1122_\\\\(9824-22a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96C2DEDC-012D-4B9F-B9DF-344A49B67E46\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1124_\\\\(9824-42a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"ADB79297-E73F-44F2-B619-10E5A73B5BBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1124_\\\\(9824-42a\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25BCA648-5FF1-4B90-98ED-23E5BB217465\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1124_\\\\(9824-42a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F51514A-8E29-42D1-B874-838F8A0869D2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122s_\\\\(9824-22b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"7A7F8526-E3B1-4930-816A-CDF15D0E18EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1122s_\\\\(9824-22b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2165EAA9-EDC9-4010-9D31-294F9414A9E6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1122s_\\\\(9824-22b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26E1E16B-8F95-46EC-BAA0-0A53F332292B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1114_\\\\(9824-41b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"9B3F6D87-A1A2-482E-A977-2C282AD78586\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1114_\\\\(9824-41b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"085F1C27-D806-4E4B-A44A-BB3C056CFCF7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1114_\\\\(9824-41b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8688E552-BE38-4EB9-8514-D7060C548C39\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1122_\\\\(9856-22h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"16CF6969-4E38-4C0B-82C4-1B9A82A080D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1122_\\\\(9856-22h\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50916B93-7340-4344-AF34-91836ABE508F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1122_\\\\(9856-22h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1124_\\\\(9856-42h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"6E33E2CC-0159-4B35-82B4-CAC55A7EFB36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1124_\\\\(9856-42h\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FECCD687-64E7-45B4-BCB7-AEF25164D049\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1124_\\\\(9856-42h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1150_\\\\(9043-mru\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"181DFBD2-63D1-481C-909F-226E448DBE34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1150_\\\\(9043-mru\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE428FBB-4DDC-4E05-A5C3-F37BE9395723\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1150_\\\\(9043-mru\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC9D9EFF-1E92-4894-9976-001227F78869\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1112_\\\\(9242-21b\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6505E499-E766-451D-9996-1668BE53AAF8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1112_\\\\(9242-21b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3F5100A-FE2A-412C-9B57-B616B97B1142\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1112_\\\\(9242-21t\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"109DE27E-5F87-4BD0-8C48-F72A1C2AD55D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1112_\\\\(9242-21t\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA825307-2083-4264-8E8B-798661285261\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1080_\\\\(9080-hex\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"6F78F02D-DDCB-410F-82B3-88B178E78455\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1080_\\\\(9080-hex\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF85251B-E02C-4293-98F0-D331BF51CAC4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1022_\\\\(9105-22a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"F58A081E-15BC-4593-9849-50F1A2D94597\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1022_\\\\(9105-22a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1024_\\\\(9105-42a\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"63BBEE95-BD5A-47DF-8A65-AB824BB4ED9B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1024_\\\\(9105-42a\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E49EE658-B8AE-48F7-A765-92BA3A630AA0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1022s_\\\\(9105-22b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"0E7C5359-B6C1-4053-B478-0C21A4BF7912\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1022s_\\\\(9105-22b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1014_\\\\(9105-41b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"EDFC9BBD-E8FF-48E1-A7EB-99FA20A89E47\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1014_\\\\(9105-41b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECD54B80-5754-4C19-AE0C-F539DEF96DCB\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1022_\\\\(9786-22h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"95F860E2-1170-40BB-810A-ADFAA4475027\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1022_\\\\(9786-22h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2C09090-C18F-464A-8DEF-E23B5990E2A4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_l1024_\\\\(9786-42h\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"8E31A0F0-9145-4851-A4D3-28001365C35C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_l1024_\\\\(9786-42h\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0170400B-89A7-4B44-9AA7-9A168C9CAE9C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1050_\\\\(9043-mrx\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"CDBE6EC6-7BD4-424D-B895-3D87B22C01A6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1050_\\\\(9043-mrx\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"061D193E-84BC-4DE7-96C4-B75D11769ED5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s1012_\\\\(9028-21b\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1060.00\",\"versionEndExcluding\":\"fw1060.72\",\"matchCriteriaId\":\"AF18870B-E9BD-49AF-944F-A6AC22E2B455\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s1012_\\\\(9028-21b\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BED85F2-8CCB-417C-A739-23828966A036\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1180_\\\\(9080-heu\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw1110.00\",\"versionEndExcluding\":\"fw1110.30\",\"matchCriteriaId\":\"55A85DB0-D67F-4E20-BE54-863662C180E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e1180_\\\\(9080-heu\\\\)_firmware:fw1120.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F518B3DD-3F25-4581-9103-6CD4D8DA54C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e1180_\\\\(9080-heu\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s922_\\\\(9009-22g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"0C406C5A-454C-4454-861F-80E629B68418\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s922_\\\\(9009-22g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95E5E77F-A5BB-46E7-B6B6-B02F242DE829\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_h922_\\\\(9223-22s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"FBE7D8B3-902D-4CD1-9F31-454E293A79B3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_h922_\\\\(9223-22s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7851003-8D6B-4FE8-87D7-BE968E85E448\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s914_\\\\(9009-41g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"CD77C09F-AF62-4CD8-B64C-CDF50D696648\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s914_\\\\(9009-41g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"003F591A-ACCD-497E-BF8A-DE090321D778\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_s924_\\\\(9009-42g\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"54831AF9-D748-4649-A0ED-896341845BCD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_s924_\\\\(9009-42g\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_h924_\\\\(9223-42s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"64FD3222-EEFD-4533-A088-B05F04E0831D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_h924_\\\\(9223-42s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e950_\\\\(9040-mr9\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"C99CF91B-A98D-4795-A8AE-998713989ABE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e950_\\\\(9040-mr9\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:power_system_e980_\\\\(9080-m9s\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"fw950.00\",\"versionEndExcluding\":\"fw950.h3\",\"matchCriteriaId\":\"272B1267-28AC-4BDB-93C4-9804DBE240E0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:power_system_e980_\\\\(9080-m9s\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BE56BD8-DB0F-4151-9428-42F1B6452D99\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7283890\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4936\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T13:28:12.630911Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T13:28:55.531Z\"}}], \"cna\": {\"title\": \"Power System Insufficient Entropy\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.1, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*\", \"cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"PowerVM Hypervisor\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW1110.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW1110.20\"}, {\"status\": \"affected\", \"version\": \"FW1060.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW1060.71\"}, {\"status\": \"affected\", \"version\": \"FW950.00\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"FW950.H2\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\\nPower 11\\n\\n * IBM Power System E1180 (9080-HEU)\\n\\n\\nCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\\nPower 11\\n\\n * IBM Power System S1122 (9824-22A)\\n * IBM Power System S1124 (9824-42A)\\n * IBM Power System S1122s (9824-22B)\\n * IBM Power System S1114 (9824-41B)\\n * IBM Power System L1122 (9856-22H)\\n * IBM Power System L1124 (9856-42H)\\n * IBM Power System E1150 (9043-MRU)\\n\\n\\nCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\\n\\n\\n\\nPower 11\\n\\n * IBM Power System S1112 (9242-21B, 9242-21T)\\n\\n\\n\\nCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\\nPower 10\\n\\n * IBM Power System E1080 (9080-HEX)\\n\\n\\nCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\\nPower 10\\n\\n * IBM Power System S1022 (9105-22A)\\n * IBM Power System S1024 (9105-42A)\\n * IBM Power System S1022s (9105-22B)\\n * IBM Power System S1014 (9105-41B)\\n * IBM Power System L1022 (9786-22H)\\n * IBM Power System L1024 (9786-42H)\\n * IBM Power System E1050 (9043-MRX)\\n * IBM Power System S1012 (9028-21B)\\n\\n\\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\\nPower 9\\n\\n * IBM Power System S922 (9009-22G)\\n * IBM Power System H922 (9223-22S)\\n * IBM Power System S914 (9009-41G)\\n * IBM Power System S924 (9009-42G)\\n * IBM Power System H924 (9223-42S)\\n * IBM Power System E950 (9040-MR9)\\n * IBM Power System E980 (9080-M9S)\\n\\n\\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCustomers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1180 (9080-HEU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1122 (9824-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1124 (9824-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1122s (9824-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1114 (9824-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1122 (9856-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1124 (9856-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1150 (9043-MRU)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 11\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1112 (9242-21B, 9242-21T)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cbr/\u003eCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System E1080 (9080-HEX)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S1022 (9105-22A)\u003c/li\u003e\u003cli\u003eIBM Power System S1024 (9105-42A)\u003c/li\u003e\u003cli\u003eIBM Power System S1022s (9105-22B)\u003c/li\u003e\u003cli\u003eIBM Power System S1014 (9105-41B)\u003c/li\u003e\u003cli\u003eIBM Power System L1022 (9786-22H)\u003c/li\u003e\u003cli\u003eIBM Power System L1024 (9786-42H)\u003c/li\u003e\u003cli\u003eIBM Power System E1050 (9043-MRX)\u003c/li\u003e\u003cli\u003eIBM Power System S1012 (9028-21B)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\u003cbr/\u003ePower 9\u003c/p\u003e\u003col\u003e\u003cli\u003eIBM Power System S922 (9009-22G)\u003c/li\u003e\u003cli\u003eIBM Power System H922 (9223-22S)\u003c/li\u003e\u003cli\u003eIBM Power System S914 (9009-41G)\u003c/li\u003e\u003cli\u003eIBM Power System S924 (9009-42G)\u003c/li\u003e\u003cli\u003eIBM Power System H924 (9223-42S)\u003c/li\u003e\u003cli\u003eIBM Power System E950 (9040-MR9)\u003c/li\u003e\u003cli\u003eIBM Power System E980 (9080-M9S)\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003cem\u003eThe images mentioned above can be located at IBM Fix Central : \u003c/em\u003e\u003ca href=\\\"https://www.ibm.com/support/fixcentral/\\\" rel=\\\"noopener noreferrer nofollow\\\"\u003e\u003cem\u003ehttps://www.ibm.com/support/fixcentral/\u003c/em\u003e\u003c/a\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7283890\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\\n\\n\\n\\nBefore issuing the resource dump, confirm all of the following:\\n\\n * The system is at runtime.\\n * There are no outstanding recovery actions (the system must not be in \\\"Recovery\\\" state on the HMC).\\n * There are no unresolved action-required PEL entries.\\n * The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\\n\\n\\n\\n\\nThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\\n\\n\\n\\nHMC-attached systems : \\u00a0 https://www.ibm.com/support/pages/node/667943 \\n\\n * Use selector: sbmgr -regenerateKeys\\n\\n\\n\\n\\nFSP-based standalone systems:\\n\\n * Log onto the system ASM with admin credentials\\n * Navigate to System Service Aids -\u003e Resource Dump\\n * Initiate the resource dump\\n * Use selector: sbmgr -regenerateKeys\\n\\n\\n\\n\\n\\n\\n\\nBMC-based standalone systems:\\n\\n * Log onto the system ASMi with admin credentials\\n * Navigate to Logs and Services -\u003e Dumps -\u003e Select a dump -\u003e Resource Dump\\n * Initiate the resource dump:\\n * Use selector: sbmgr -regenerateKeys\\n\\n\\n\\n\\n\\n\\n\\nFor HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\\n\\n\\n\\nTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\\n\\n * HMC CLI (SSH):\\u00a0ls -ltr\\u00a0/dump/RSCDUMP.*\\n * Validate the Serial Number and date of dump.\\n\\n\\n\\n\\nOnce the dump has offloaded to the HMC, check in the HMC\\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\\n\\n\\n\\nFor standalone servers, the resource dump will be uploaded to the Operating System.\\n\\n * Linux: Server level dumps, including Resource Dumps, will be placed in directory:\\u00a0/var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.\\n * IBM i: Server level dumps, including Resource Dumps, will be copied into the\\u00a0Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\\n * AIX: Server level dumps, including Resource Dumps, will be placed in directory:\\u00a0/var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt.\\u00a0 IBM Service may be needed to determine if the event is a B7009021\\n\\n\\n\\n\\nLastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFollowing successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\u003c/p\u003e\u003cp\u003eBefore issuing the resource dump, confirm all of the following:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe system is at runtime.\u003c/li\u003e\u003cli\u003eThere are no outstanding recovery actions (the system must not be in \\\"Recovery\\\" state on the HMC).\u003c/li\u003e\u003cli\u003eThere are no unresolved action-required PEL entries.\u003c/li\u003e\u003cli\u003eThe system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\u003c/p\u003e\u003cp\u003eHMC-attached systems : \\u00a0\u003ca href=\\\"https://www.ibm.com/support/pages/node/667943\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/667943\u003c/a\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFSP-based standalone systems:\u003c/p\u003e\u003cul\u003e\u003cli\u003eLog onto the system ASM with admin credentials\u003c/li\u003e\u003cli\u003eNavigate to System Service Aids -\u0026gt; Resource Dump\u003c/li\u003e\u003cli\u003eInitiate the resource dump\\n\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eBMC-based standalone systems:\u003c/p\u003e\u003cul\u003e\u003cli\u003eLog onto the system ASMi with admin credentials\u003c/li\u003e\u003cli\u003eNavigate to Logs and Services -\u0026gt; Dumps -\u0026gt; Select a dump -\u0026gt; Resource Dump\u003c/li\u003e\u003cli\u003eInitiate the resource dump:\\n\u003cul\u003e\u003cli\u003eUse selector: \u003cem\u003e\u003cstrong\u003esbmgr -regenerateKeys\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor \u003cstrong\u003eHMC managed systems,\u003c/strong\u003e after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\u003c/p\u003e\u003cp\u003eTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\u003c/p\u003e\u003cul\u003e\u003cli\u003eHMC CLI (SSH):\\u00a0\u003cem\u003els -ltr\\u00a0/dump/RSCDUMP.*\u003c/em\u003e\u003c/li\u003e\u003cli\u003eValidate the Serial Number and date of dump.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eOnce the dump has offloaded to the HMC, check in the HMC\\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\u003c/p\u003e\u003cp\u003eFor \u003cstrong\u003estandalone servers\u003c/strong\u003e, the resource dump will be uploaded to the Operating System.\u003c/p\u003e\u003cul\u003e\u003cli\u003eLinux: Server level dumps, including Resource Dumps, will be placed in directory:\\u00a0\u003cstrong\u003e/var/log/dump/\u003c/strong\u003e. A B7009021 would present as a permanent error in the PPC64 platform log file.\u003c/li\u003e\u003cli\u003eIBM i: Server level dumps, including Resource Dumps, will be copied into the\\u00a0\u003cstrong\u003eMain Storage Dump Manager\u003c/strong\u003e in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\u003c/li\u003e\u003cli\u003eAIX: Server level dumps, including Resource Dumps, will be placed in directory:\\u00a0\u003cstrong\u003e/var/adm/ras/platform/\u003c/strong\u003e. A B7009021 would present Permanent sysplanar error in the errpt.\\u00a0 IBM Service may be needed to determine if the event is a B7009021\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eLastly:\u003c/strong\u003e Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-331\", \"description\": \"CWE-331 Insufficient Entropy\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-08-19T20:14:55.609Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-4936\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T13:29:02.461Z\", \"dateReserved\": \"2026-03-26T20:32:20.576Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-08-19T20:14:55.609Z\", \"assignerShortName\": \"ibm\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…