Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T20:17:12.983Z",
  "pubdate": "2026-08-19T20:17:12.983Z",
  "executiveSummary": "IBM PowerVM Hypervisor partition firmware contains a vulnerability that impacts network boot operations.\nThe vulnerability affects IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 on Power Systems Firmware.\nAn unauthenticated attacker positioned on the same network segment as a target partition performing a network boot can disrupt the boot sequence, resulting in availability loss.\nFurthermore, on configurations where Operating System secure boot is not enabled (which represents the default state), the adversary can inject and substitute a malicious boot image.\nThis unauthorized substitution compromises all subsequent code and data loaded by the affected partition, yielding complete confidentiality, integrity, and availability impacts.\nExploitation is strictly limited to partitions actively executing a network boot routine; other system partitions and the core managed system remain unaffected.\nThe primary risk entails local network adversaries achieving arbitrary code execution during early boot phases on insecurely configured partitions.",
  "technicalDetails": "The root cause of the vulnerability resides in the partition firmware handling of network boot sequences within IBM PowerVM Hypervisor.\nThe vulnerable component is the network boot subsystem of the partition firmware.\nAffected versions comprise IBM PowerVM Hypervisor firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nNo authentication or elevated privileges are required for exploitation, as the attacker merely needs network access to the broadcast or collision domain utilized during the partition network boot process.\nNetwork exposure is restricted to the local network segment through which the partition initiates its network boot protocol.\nThe attack flow proceeds as follows: First, the attacker monitors the local network to identify when a target partition initiates a network boot sequence.\nSecond, leveraging the lack of cryptographic validation or integrity checks in default configurations (where OS secure boot is disabled), the attacker injects malicious responses or forged network boot payloads onto the wire.\nThird, the vulnerable partition firmware accepts the malicious boot image instead of the legitimate deployment artifact.\nPayload behavior involves executing unauthorized code during the partition initialization phase.\nPost-exploitation impact includes full compromise of the affected partition, allowing the attacker to subvert all subsequent software, services, and data loaded or processed by the guest partition."
}