CVE-2026-4937

MediumCVSS 5.3

Published: 19/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

IBM PowerVM Hypervisor in certain firmware versions allows a local attacker with administrative privileges to decrypt encrypted data because some hypervisor calls use less entropy than requested.

Risk Assessment

An attacker with administrative privileges can break encryption and access sensitive data, posing a serious confidentiality risk.

Recommendation

Apply available IBM PowerVM firmware updates that address this issue.

Original NVD description (English source)

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.