CVE-2026-14971 identifies a configuration vulnerability in IBM PowerVM Novalink APIs in versions 2.2.02.2.12.2.1.1 and 2.3.02.3.0.12.3.12.3.2. The misconfiguration could increase the attack surface and enable unintended or unauthorized operations when non-default configurations are used. The vulnerability is categorized as CWE-16, relating to improper configuration. The CVSS v3.1 base score is 3.9 (low), with attack vector local, high attack complexity, high privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

The vulnerability may allow attackers with local access and high privileges to perform unintended or unauthorized operations due to API misconfiguration. The impact on confidentiality, integrity, and availability is low. There are no known exploits in the wild. The risk is limited by the requirement for high privileges and local access, as well as high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided by IBM, review and harden API configurations to avoid non-default settings that could increase the attack surface. Monitor IBM advisories for updates.