CVE-2026-17414 is an improper input validation vulnerability (CWE-20) in IBM PowerVM Hypervisor partition firmware during network boot. It affects specific firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An unauthenticated attacker with network access to a partition performing network boot can prevent the boot sequence from completing. If OS secure boot is disabled (default), the attacker can substitute the boot image, compromising the partition's subsequent software load. The vulnerability does not affect other partitions or the managed system. The CVSS 3.1 score is 8.1 (high severity) with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact.

The vulnerability allows an unauthenticated attacker on the same network segment to disrupt the boot process of a partition performing network boot, causing denial of service. Additionally, if OS secure boot is not enabled, the attacker can substitute the boot image, leading to compromise of the partition's integrity and potentially executing malicious code. Other partitions and the overall managed system remain unaffected. The impact affects confidentiality, integrity, and availability of the targeted partition during network boot.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, enabling OS secure boot on partitions performing network boot can mitigate the risk of boot image substitution. Network segmentation to restrict access to the network boot environment may reduce exposure. Monitor IBM advisories for official patches or updates.