CVE-2026-4936: IBM PowerVM Information Disclosure Flaw

CVE-2026-4936 Overview

CVE-2026-4936 is a cryptographic weakness in the IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual Trusted Platform Module (vTPM). The affected firmware uses persistent storage key seeds that produce an Advanced Encryption Standard (AES) key with reduced effective strength. An attacker with access to the service processor or the Hardware Management Console (HMC) can derive the encryption key and read data protected by PKS or the vTPM. The weakness is tracked under CWE-331: Insufficient Entropy.

Critical Impact
An adjacent-network attacker with high privileges on the service processor or HMC can recover AES keys and decrypt PKS and vTPM-protected secrets on affected PowerVM firmware.

Affected Products

IBM PowerVM Hypervisor firmware FW1110.00 through FW1110.20
IBM PowerVM Hypervisor firmware FW1060.00 through FW1060.71
IBM PowerVM Hypervisor firmware FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-4936 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-4936

Vulnerability Analysis

The PowerVM Hypervisor Platform KeyStore stores platform secrets, and the virtual TPM provides TPM services to logical partitions (LPARs). Both components rely on AES encryption to protect keys and measurements at rest. According to the IBM advisory, the firmware derives AES keys from persistent storage key seeds that do not carry the full entropy expected for the key size. The result is an AES key with reduced strength, which shortens the effective search space for an attacker attempting to recover the key. An attacker who reaches the service processor or the HMC can read the seed material and reproduce the derivation, then decrypt PKS entries or vTPM state. Because the affected keys protect platform-level secrets, compromise undermines the confidentiality guarantees that customers rely on the vTPM and PKS to provide.

Root Cause

The root cause is insufficient entropy in the key derivation process (CWE-331). Persistent seeds used by the firmware do not produce a full-strength AES key, so the derived key is weaker than its nominal bit length suggests.

Attack Vector

Exploitation requires adjacent-network access with high privileges on the service processor or the HMC, plus user interaction. An attacker in that position reads the persistent seed material, replays the derivation to compute the AES key, and then decrypts PKS or vTPM ciphertext. Successful exploitation compromises confidentiality of platform secrets but does not directly modify integrity or availability. No proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the IBM Support Page for the vendor description of the flaw.

Detection Methods for CVE-2026-4936

Indicators of Compromise

Unexpected administrative sessions to the HMC or Flexible Service Processor (FSP), especially from unusual source addresses on the management network.
Access to PKS or vTPM interfaces from accounts that do not routinely manage cryptographic material.
HMC or service processor firmware versions matching FW1110.00–FW1110.20, FW1060.00–FW1060.71, or FW950.00–FW950.H2 without the fix applied.

Detection Strategies

Audit HMC and service processor logs for authentication events, command history, and configuration changes that touch PKS or vTPM.
Compare running firmware levels against IBM's fixed release list and flag systems still on vulnerable builds.
Alert on management-network traffic that reaches the HMC or FSP from segments that are not explicitly authorized administrative subnets.

Monitoring Recommendations

Forward HMC syslog and service processor audit trails to a centralized SIEM for correlation with identity and network events.
Track use of privileged HMC roles such as hmcsuperadmin and monitor for role changes or new user creation.
Baseline normal PKS and vTPM operations per partition, then alert on volume or timing anomalies.

How to Mitigate CVE-2026-4936

Immediate Actions Required

Inventory PowerVM systems and identify firmware versions in the affected ranges.
Restrict HMC and service processor access to a dedicated, segmented management network with strict access control lists.
Rotate credentials for HMC and service processor accounts and enforce multi-factor authentication where supported.
Plan a maintenance window to apply the IBM firmware fix on all affected systems.

Patch Information

IBM has published guidance and fix information on the IBM Support Page for CVE-2026-4936. Administrators should upgrade PowerVM Hypervisor firmware to a level above the affected ranges (FW1110.20, FW1060.71, and FW950.H2) using the release identified by IBM. After patching, rotate any keys stored in PKS or provisioned in vTPM instances that existed on vulnerable firmware, because previously stored material may have been derived under the weak scheme.

Workarounds

Limit HMC and FSP reachability to a hardened jump host and block direct access from general-purpose administrative workstations.
Reduce the number of accounts with high-privilege HMC roles and review remaining accounts for necessity.
Treat existing PKS entries and vTPM-sealed data as potentially exposed until firmware is updated and keys are rotated.

bash

# Example: check current PowerVM firmware level from the HMC command line
lssyscfg -r sys -F name,type_model,serial_num,state,curr_power_on_side,activated_level

# Example: view installed firmware levels for a managed system
lslic -m <managed_system_name> -t sys -F ecnumber,activated_level,installed_level