Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T20:17:11.973Z",
  "pubdate": "2026-08-19T20:17:11.973Z",
  "executiveSummary": "A denial of service vulnerability exists within the partition firmware of the IBM PowerVM Hypervisor during the network boot sequence. The vulnerability impacts availability by allowing an unauthenticated network-adjacent attacker to prevent targeted partitions from successfully completing an iSCSI SAN network boot process. The affected products include IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. Exploitation of this flaw is strictly limited to partitions actively performing an iSCSI SAN network boot on the same network segment. Other partitions and the broader managed system remain unaffected. The risk is constrained to operational availability, preventing system startup during the vulnerable boot phase without compromising data confidentiality or integrity.",
  "technicalDetails": "The vulnerability resides in the partition firmware handling of the network boot mechanism specifically when utilizing the iSCSI protocol. The root cause stems from improper validation or handling of network traffic during the iSCSI SAN boot sequence, making the vulnerable component susceptible to disruption by entities sharing the local network medium. An unauthenticated attacker positioned on the same network as the booting partition can execute the attack flow by targeting the network traffic or state machine exchanges occurring during the iSCSI boot phase. Because the firmware lacks robust resilience or error handling against malicious or malformed network interference during this critical initialization window, the interruption causes the partition's boot sequence to stall or fail outright. The attack vector requires network access to the same broadcast or routed collision domain where the iSCSI SAN network boot is actively taking place. No privileges or authentication are required by the threat actor, as the attack leverages the inherent exposure of unencrypted and unverified boot-time network transactions. The post-exploitation impact is limited entirely to a localized denial of service affecting only the specific partition undergoing the iSCSI boot procedure at the exact time of interference. The hypervisor itself, along with other concurrently running partitions on the managed system, remains isolated and stable, experiencing no collateral impact to their processing capabilities or runtime integrity."
}