This Power System update is being released to address
Priority LOW 15CWE-1262Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer partition in specific shared processor configurations during certain operations.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | PowerVM Hypervisor | FW1110.00 – FW1110.03; FW1060.00 – FW1060.51; FW950.00 – FW950.F0 | — | No fix listed | CNA |
- PowerVM Hypervisor VendorIBM Affected FW1110.00 – FW1110.03; FW1060.00 – FW1060.51; FW950.00 – FW950.F0 Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:* | fw950.00 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.10:*:*:*:*:*:*:* | fw950.10 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.11:*:*:*:*:*:*:* | fw950.11 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.20:*:*:*:*:*:*:* | fw950.20 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.30:*:*:*:*:*:*:* | fw950.30 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.40:*:*:*:*:*:*:* | fw950.40 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.50:*:*:*:*:*:*:* | fw950.50 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.60:*:*:*:*:*:*:* | fw950.60 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.70:*:*:*:*:*:*:* | fw950.70 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.71:*:*:*:*:*:*:* | fw950.71 | Vulnerable | IBM |
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:* Versions fw950.00 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.10:*:*:*:*:*:*:* Versions fw950.10 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.11:*:*:*:*:*:*:* Versions fw950.11 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.20:*:*:*:*:*:*:* Versions fw950.20 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.30:*:*:*:*:*:*:* Versions fw950.30 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.40:*:*:*:*:*:*:* Versions fw950.40 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.50:*:*:*:*:*:*:* Versions fw950.50 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.60:*:*:*:*:*:*:* Versions fw950.60 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.70:*:*:*:*:*:*:* Versions fw950.70 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.71:*:*:*:*:*:*:* Versions fw950.71 Vulnerable ·IBM
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.80:*:*:*:*:*:*:* | fw950.80 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.90:*:*:*:*:*:*:* | fw950.90 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.a0:*:*:*:*:*:*:* | fw950.a0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.b0:*:*:*:*:*:*:* | fw950.b0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.c0:*:*:*:*:*:*:* | fw950.c0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.c1:*:*:*:*:*:*:* | fw950.c1 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.c2:*:*:*:*:*:*:* | fw950.c2 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.d0:*:*:*:*:*:*:* | fw950.d0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.d1:*:*:*:*:*:*:* | fw950.d1 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.e0:*:*:*:*:*:*:* | fw950.e0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.e1:*:*:*:*:*:*:* | fw950.e1 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw950.f0:*:*:*:*:*:*:* | fw950.f0 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:* | fw1060.00 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.10:*:*:*:*:*:*:* | fw1060.10 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.12:*:*:*:*:*:*:* | fw1060.12 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.20:*:*:*:*:*:*:* | fw1060.20 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.21:*:*:*:*:*:*:* | fw1060.21 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.40:*:*:*:*:*:*:* | fw1060.40 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.41:*:*:*:*:*:*:* | fw1060.41 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.50:*:*:*:*:*:*:* | fw1060.50 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1060.51:*:*:*:*:*:*:* | fw1060.51 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:* | fw1110.00 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1110.01:*:*:*:*:*:*:* | fw1110.01 | Vulnerable | IBM |
| cpe:2.3:o:ibm:powervm_hypervisor:fw1110.03:*:*:*:*:*:*:* | fw1110.03 | Vulnerable | IBM |
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.80:*:*:*:*:*:*:* Versions fw950.80 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.90:*:*:*:*:*:*:* Versions fw950.90 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.a0:*:*:*:*:*:*:* Versions fw950.a0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.b0:*:*:*:*:*:*:* Versions fw950.b0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.c0:*:*:*:*:*:*:* Versions fw950.c0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.c1:*:*:*:*:*:*:* Versions fw950.c1 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.c2:*:*:*:*:*:*:* Versions fw950.c2 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.d0:*:*:*:*:*:*:* Versions fw950.d0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.d1:*:*:*:*:*:*:* Versions fw950.d1 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.e0:*:*:*:*:*:*:* Versions fw950.e0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.e1:*:*:*:*:*:*:* Versions fw950.e1 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw950.f0:*:*:*:*:*:*:* Versions fw950.f0 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:* Versions fw1060.00 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.10:*:*:*:*:*:*:* Versions fw1060.10 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.12:*:*:*:*:*:*:* Versions fw1060.12 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.20:*:*:*:*:*:*:* Versions fw1060.20 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.21:*:*:*:*:*:*:* Versions fw1060.21 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.40:*:*:*:*:*:*:* Versions fw1060.40 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.41:*:*:*:*:*:*:* Versions fw1060.41 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.50:*:*:*:*:*:*:* Versions fw1060.50 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1060.51:*:*:*:*:*:*:* Versions fw1060.51 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:* Versions fw1110.00 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1110.01:*:*:*:*:*:*:* Versions fw1110.01 Vulnerable ·IBM
- cpe:2.3:o:ibm:powervm_hypervisor:fw1110.03:*:*:*:*:*:*:* Versions fw1110.03 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-36194
- 2026-10-03 Alias added: GHSA-vfp9-7p35-gg6g
References
More IBM Powervm Hypervisor vulnerabilities
- TI-2022-15241 IBM Power FW security bypass CVSS 3.1CRITICAL 9.8
- TI-2023-14280 IBM PowerVM gain access CVSS 3.1CRITICAL 9.3
- TI-2021-16362 IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service… CVSS 3.1CRITICAL 9.1
- TI-2021-16363 IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM… CVSS 3.1HIGH 7.5
- TI-2023-14281 IBM PowerVM Hypervisor denial of service CVSS 3.1HIGH 7.9
- TI-2023-10961 IBM PowerVM Hypervisor information disclosure CVSS 3.1HIGH 7.5
Sources
- CVE-2025-36194 · CVE Program
- CVE-2025-36194 · NVD
- FIRST EPSS
- GHSA-vfp9-7p35-gg6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences