CVE-2026-4936: Power System Insufficient Entropy
IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
Other sources
PowerVM Platform KeyStore (PKS) and virtual TPM use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power System firmware (service processor/HMC)to a version that resolves this vulnerability.Fixed in FW1060.72(1060_171) / FW1060.80(1060_180)Patch FW1060.72(1060_171) / FW1060.80(1060_180) - Upgrade
Upgrade
IBM Power System firmware (service processor/HMC)to a version that resolves this vulnerability.Fixed in FW1060.72(1060_177) / FW1060.80(1060_185)Patch FW1060.72(1060_177) / FW1060.80(1060_185) - Upgrade
Upgrade
IBM PowerVM/virtual TPM firmwareto a version that resolves this vulnerability.Fixed in FW1120.00(1120_183)Patch FW1120.00(1120_183) - Upgrade
Upgrade
IBM PowerVM/virtual TPM firmwareto a version that resolves this vulnerability.Fixed in FW950.H3(950_230)Patch FW950.H3(950_230)
Event History
Frequently Asked Questions
What access and conditions are required to exploit this issue?
The attacker needs access to the service processor or Hardware Management Console (HMC). The supplied vector also indicates high attack complexity, high privileges, adjacent-network access, and user interaction are required.
What is the expected security impact if exploitation succeeds?
An attacker could derive the affected encryption key and access protected data. The supplied vector indicates high confidentiality impact, with no integrity or availability impact.