CVE-2026-15961: CWE-134 Use of Externally-Controlled Format String in IBM PowerVM Hypervisor
CVE-2026-15961 is a medium severity vulnerability in IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It involves improper control of externally-controlled format strings, which could allow a local attacker with high privileges to obtain sensitive information or cause a denial of service. The vulnerability requires high attack complexity and privileges, with no user interaction needed.
AI Analysis
Technical Summary
IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 contain a CWE-134 Use of Externally-Controlled Format String vulnerability. This flaw allows a local attacker with high privileges to exploit improper format string handling, potentially leading to information disclosure or denial of service conditions. The CVSS 3.1 base score is 5.2, reflecting medium severity with attack vector local, high attack complexity, and high privileges required.
Potential Impact
A local attacker with high privileges can exploit this vulnerability to gain access to sensitive information or cause a denial of service on the affected IBM PowerVM Hypervisor versions. The impact includes confidentiality loss and availability disruption. Integrity impact is low. No known exploits are reported in the wild.
Mitigation Recommendations
No patch or remediation information is currently available. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users with high privileges to reduce risk.
CVE-2026-15961: CWE-134 Use of Externally-Controlled Format String in IBM PowerVM Hypervisor
Description
CVE-2026-15961 is a medium severity vulnerability in IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It involves improper control of externally-controlled format strings, which could allow a local attacker with high privileges to obtain sensitive information or cause a denial of service. The vulnerability requires high attack complexity and privileges, with no user interaction needed.
CVSS v3.1
Score 5.2medium
Affected software
IBM
PowerVM Hypervisor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 contain a CWE-134 Use of Externally-Controlled Format String vulnerability. This flaw allows a local attacker with high privileges to exploit improper format string handling, potentially leading to information disclosure or denial of service conditions. The CVSS 3.1 base score is 5.2, reflecting medium severity with attack vector local, high attack complexity, and high privileges required.
Potential Impact
A local attacker with high privileges can exploit this vulnerability to gain access to sensitive information or cause a denial of service on the affected IBM PowerVM Hypervisor versions. The impact includes confidentiality loss and availability disruption. Integrity impact is low. No known exploits are reported in the wild.
Mitigation Recommendations
No patch or remediation information is currently available. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users with high privileges to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-07-16T14:14:20.484Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a85bfc5acd9273b49338bd9
Added to database: 08/19/2026, 14:37:57 UTC
Last enriched: 09/11/2026, 08:32:59 UTC
Last updated: 10/02/2026, 02:46:03 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.