IBM PowerVM Hypervisor FW1110.00-1110.20 Local Admin Decrypt via Low Entropy
CVE-2026-4937 Published on August 19, 2026
Power System Insufficient Entropy
IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.
Vulnerability Analysis
CVE-2026-4937 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Insufficient Entropy
The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Products Associated with CVE-2026-4937
Want to know whenever a new CVE is published for IBM Power Systems Firmware? stack.watch will email you.
Affected Versions
IBM PowerVM Hypervisor:- Version FW1110.00, <= FW1110.20 is affected.
- Version FW1060.00, <= FW1060.71 is affected.
- Version FW950.00, <= FW950.H2 is affected.