Security Bulletin
Summary
PowerVM Platform KeyStore (PKS) and virtual TPM use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
Vulnerability Details
CVEID: CVE-2026-4936
DESCRIPTION: PowerVM Platform KeyStore (PKS) and virtual TPM use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
CWE: CWE-331: Insufficient Entropy
CVSS Source: IBM
CVSS Base score: 5.1
CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| PowerVM Hypervisor | FW1110.00 - FW1110.20 |
| PowerVM Hypervisor | FW1060.00 - FW1060.71 |
| PowerVM Hypervisor | FW950.00 - FW950.H2 |
Remediation/Fixes
Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.
Power 11
- IBM Power System E1180 (9080-HEU)
Customers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.
Power 11
- IBM Power System S1122 (9824-22A)
- IBM Power System S1124 (9824-42A)
- IBM Power System S1122s (9824-22B)
- IBM Power System S1114 (9824-41B)
- IBM Power System L1122 (9856-22H)
- IBM Power System L1124 (9856-42H)
- IBM Power System E1150 (9043-MRU)
Customers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.
Power 11
- IBM Power System S1112 (9242-21B, 9242-21T)
Customers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.
Power 10
- IBM Power System E1080 (9080-HEX)
Customers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.
Power 10
- IBM Power System S1022 (9105-22A)
- IBM Power System S1024 (9105-42A)
- IBM Power System S1022s (9105-22B)
- IBM Power System S1014 (9105-41B)
- IBM Power System L1022 (9786-22H)
- IBM Power System L1024 (9786-42H)
- IBM Power System E1050 (9043-MRX)
- IBM Power System S1012 (9028-21B)
Customers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.
Power 9
- IBM Power System S922 (9009-22G)
- IBM Power System H922 (9223-22S)
- IBM Power System S914 (9009-41G)
- IBM Power System S924 (9009-42G)
- IBM Power System H924 (9223-42S)
- IBM Power System E950 (9040-MR9)
- IBM Power System E980 (9080-M9S)
The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/
Workarounds and Mitigations
Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.
Before issuing the resource dump, confirm all of the following:
- The system is at runtime.
- There are no outstanding recovery actions (the system must not be in "Recovery" state on the HMC).
- There are no unresolved action-required PEL entries.
- The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.
The required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:
HMC-attached systems : https://www.ibm.com/support/pages/node/667943
- Use selector: sbmgr -regenerateKeys
FSP-based standalone systems:
- Log onto the system ASM with admin credentials
- Navigate to System Service Aids -> Resource Dump
- Initiate the resource dump
- Use selector: sbmgr -regenerateKeys
BMC-based standalone systems:
- Log onto the system ASMi with admin credentials
- Navigate to Logs and Services -> Dumps -> Select a dump -> Resource Dump
- Initiate the resource dump:
- Use selector: sbmgr -regenerateKeys
For HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.
To monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:
- HMC CLI (SSH): ls -ltr /dump/RSCDUMP.*
- Validate the Serial Number and date of dump.
Once the dump has offloaded to the HMC, check in the HMC’s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.
For standalone servers, the resource dump will be uploaded to the Operating System.
- Linux: Server level dumps, including Resource Dumps, will be placed in directory: /var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.
- IBM i: Server level dumps, including Resource Dumps, will be copied into the Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.
- AIX: Server level dumps, including Resource Dumps, will be placed in directory: /var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt. IBM Service may be needed to determine if the event is a B7009021
Lastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
15 Aug 2026: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
15 August 2026
Initial Publish date:
15 August 2026
UID
ibm17283890