CVE-2026-17097

Ibm Power System S1122 \(9824-22A\) Firmware fw1110.00 – fw1110.31

Published

19 August 2026

Modified

25 August 2026

Patch / advisory

View advisory

CVSS Score v3.1 7.3

Click a component to see what it means

Raw vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

EPSS Score 0.0011 1th percentile

Risk Priority 48 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-17097 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Ibm Power System S1122 \(9824-22A\) Firmware. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-62870

Vulnerability Data

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor…

call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.

CWE(s): CWE-129

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1211 Exploitation for Stealth Stealth

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-16707Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-18821Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-17091Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-16661Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-17100Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-17093Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-17414Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-16933Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-18871Same product: Ibm Power System E1050 \(9043-Mrx\)

CVE-2026-17429Same product: Ibm Power System E1050 \(9043-Mrx\)