CVE-2026-17413— This Power System update is being released to address
Quick assessment
Affected
IBM PowerVM Hypervisor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM PowerVM Hypervisor 固件版本从 FW1120.00 到 FW1120.01、FW1110.00 到 FW1110.31、FW1060.00 到 FW1060.81，以及 FW950.00 到 FW950.H3 受到 RTAS（Run-Time Abstraction Services）固件到操作系统接口的一个漏洞影响。拥有逻辑分区（LPAR）管理员级别（root）权限的攻击者可以向分区固件发送特制请求，导致该分区崩溃且不可用。同一托管系统上的其他分区不受影响。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-17413
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
This Power System update is being released to address
Source: CVE Program / CVE List V5
Vulnerability Description
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | PowerVM Hypervisor | FW1120.00 ~ FW1120.01 |
cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-17413
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17413
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-17413 (1)
Same Patch Batch · IBM · 2026-09-24 · 19 CVEs total
| CVE-2026-81549 | 9.6 CRITICAL | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-82093 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81552 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81548 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81547 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81545 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81539 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-77874 | 8.6 HIGH | IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities |
| CVE-2026-82094 | 7.1 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-6544 | 6.2 MEDIUM | Multiple Vulnerabilities in IBM Concert Software |
| CVE-2026-17503 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-17504 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-77825 | 4.9 MEDIUM | IBM ContextForge MCP Gateway is affected by path traversal |
| CVE-2026-18870 | 4.3 MEDIUM | This Power System update is being released to address |
| CVE-2026-18857 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-17511 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-18104 | 3.3 LOW | IBM Db2 Mirror for i is vulnerable to obtain sensitive information [] |
| CVE-2026-19492 | 3.2 LOW | This Power System update is being released to address |
IV. Related Vulnerabilities
Same product: PowerVM Hypervisor
-
CVE-2026-19492
This Power System update is being released to address -
CVE-2026-18870
This Power System update is being released to address -
CVE-2026-17511
This Power System update is being released to address -
CVE-2026-17504
This Power System update is being released to address -
CVE-2026-17503
This Power System update is being released to address
Same vendor: IBM
-
CVE-2026-93030
FortiManager 4.x XML外部实体注入漏洞 -
CVE-2026-93306
This Power System update is being released to address -
CVE-2026-84862
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84882
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84884
IBM Guardium Data Protection is affected by multiple vulnera
Same weakness: CWE-129
-
CVE-2026-100836
Edgeless Systems Contrast through 1.20.0 Denial of Service v -
CVE-2026-100654
vLLM before 0.29.0 Denial of Service via out-of-range stop_t -
CVE-2026-61695
Wire Swift runtime: negative LENGTH_DELIMITED length in skip -
CVE-2026-96675
alsa-lib through 1.2.16.1 Denial of Service via pcm_multi -
CVE-2026-62866
Dasel: Selector lexer panics on trailing whitespace in `pars
V. Comments for CVE-2026-17413
No comments yet