CVE-2026-17503— This Power System update is being released to address
Quick assessment
Affected
IBM PowerVM Hypervisor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM PowerVM Hypervisor FW1120.00 至 FW1120.01、FW1110.00 至 FW1110.31、FW1060.00 至 FW1060.81 以及 FW950.00 至 FW950.H3 在分区固件运行时启动配置方面存在漏洞。拥有分区 root 权限的攻击者可以恶意修改分区 NVRAM，导致分区无法正常启动。该状态将持续存在，直到管理员介入——即删除并重新创建分区配置——才能恢复正常运行。成功利用此漏洞会导致完整性及可用性影响。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-17503
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
This Power System update is being released to address
Source: CVE Program / CVE List V5
Vulnerability Description
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | PowerVM Hypervisor | FW1120.00 ~ FW1120.01 |
cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-17503
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17503
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-17503 (1)
Same Patch Batch · IBM · 2026-09-24 · 19 CVEs total
| CVE-2026-81549 | 9.6 CRITICAL | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-82093 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81552 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81548 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81547 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81545 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-81539 | 8.8 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-77874 | 8.6 HIGH | IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities |
| CVE-2026-82094 | 7.1 HIGH | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-6544 | 6.2 MEDIUM | Multiple Vulnerabilities in IBM Concert Software |
| CVE-2026-17413 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-17504 | 5.1 MEDIUM | This Power System update is being released to address |
| CVE-2026-77825 | 4.9 MEDIUM | IBM ContextForge MCP Gateway is affected by path traversal |
| CVE-2026-18870 | 4.3 MEDIUM | This Power System update is being released to address |
| CVE-2026-18857 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-17511 | 3.4 LOW | This Power System update is being released to address |
| CVE-2026-18104 | 3.3 LOW | IBM Db2 Mirror for i is vulnerable to obtain sensitive information [] |
| CVE-2026-19492 | 3.2 LOW | This Power System update is being released to address |
IV. Related Vulnerabilities
Same product: PowerVM Hypervisor
-
CVE-2026-19492
This Power System update is being released to address -
CVE-2026-18870
This Power System update is being released to address -
CVE-2026-17511
This Power System update is being released to address -
CVE-2026-17504
This Power System update is being released to address -
CVE-2026-17413
This Power System update is being released to address
Same vendor: IBM
-
CVE-2026-93030
FortiManager 4.x XML外部实体注入漏洞 -
CVE-2026-93306
This Power System update is being released to address -
CVE-2026-84862
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84882
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84884
IBM Guardium Data Protection is affected by multiple vulnera
Same weakness: CWE-20
-
CVE-2026-12267
Authenticated PowerShell Injection in DNS Query Resolution P -
CVE-2026-12268
Authenticated PowerShell Injection leads to RCE -
CVE-2026-88771
A remote code execution vulnerability exists due to improper -
CVE-2026-100833
Contrast before 1.23.1 Image Substitution via Policy Generat -
CVE-2026-100699
Nodemailer before 10.0.9 Malformed Envelope Recipient via RF
V. Comments for CVE-2026-17503
No comments yet