CVE-2026-17414: CWE-20 Improper Input Validation in IBM PowerVM Hypervisor

IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 contain an improper input validation vulnerability (CWE-20) in partition firmware during network boot. An unauthenticated attacker with network access to a partition performing network boot can prevent the boot sequence from completing and, if OS secure boot is disabled, substitute the boot image. This substitution compromises all subsequent software loaded by that partition. The vulnerability affects only partitions actively performing network boot and does not impact other partitions or the managed system.

The vulnerability allows an unauthenticated attacker on the same network to cause denial of service by preventing a partition from completing its network boot. Additionally, if OS secure boot is not enabled (default), the attacker can compromise the integrity of the partition by substituting the boot image, leading to potential full compromise of the partition's loaded software. Confidentiality, integrity, and availability of the affected partition are impacted. Other partitions and the managed system are not affected.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Enabling OS secure boot on partitions performing network boot can mitigate the risk of boot image substitution. Network segmentation or restricting access to the network used for partition boot may reduce exposure. Monitor IBM advisories for updates on patches or official mitigations.