CVE-2026-4932: This Power System update is being released to address Insufficient Entropy
IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.
Other sources
PowerVM Hypervisor could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM Hypervisor (FW1110)to a version that resolves this vulnerability.Fixed in FW1110.30(1110_125) - Upgrade
Upgrade
IBM PowerVM Hypervisor (FW1110)to a version that resolves this vulnerability.Fixed in FW1110.30(1110_145) - Upgrade
Upgrade
IBM PowerVM Hypervisor (FW1060)to a version that resolves this vulnerability.Fixed in FW1060.72(1060_171)/FW1060.80(1060_180) - Upgrade
Upgrade
IBM PowerVM Hypervisor (FW1060)to a version that resolves this vulnerability.Fixed in FW1060.72(1060_177)/FW1060.80(1060_185) - Compensating control
Reboot the system after installing the specified IBM PowerVM Hypervisor firmware updates (FW1060.72(...)/FW1060.80(...), or FW1110.30(...)) to remediate the Insufficient Entropy vulnerability involving Transparent Memory Encryption (TME).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4932?
The severity of CVE-2026-4932 is medium with a score of 4.2.
What platforms are affected by CVE-2026-4932?
CVE-2026-4932 affects IBM PowerVM Hypervisor versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71.
How do I fix CVE-2026-4932?
To fix CVE-2026-4932, you need to update your IBM PowerVM Hypervisor to the latest version that addresses the insufficient entropy issue.
What are the potential risks of CVE-2026-4932?
CVE-2026-4932 allows an attacker with physical access to decrypt encrypted memory, which could lead to unauthorized access to sensitive information.
Who is likely to be affected by CVE-2026-4932?
Organizations using vulnerable versions of IBM PowerVM Hypervisor with physical access to their systems may be affected by CVE-2026-4932.