IBM PowerVM Hypervisor versions FW1110.00 to FW1110.20, FW1060.00 to FW1060.71, and FW950.00 to FW950.H2 contain a vulnerability (CWE-331) where certain hypervisor calls utilize less entropy than requested. This insufficient entropy can be exploited by a local attacker with administrative privileges to decrypt encrypted data. The CVSS 3.1 base score is 5.3, reflecting a medium severity with high complexity and required privileges. No vendor advisory or patch information is currently provided.

A local attacker with administrative privileges on the affected IBM PowerVM Hypervisor versions could decrypt encrypted data due to insufficient entropy in certain hypervisor calls. This compromises confidentiality but does not affect integrity or availability. The attack requires high privileges and local access, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for unusual activity related to cryptographic operations.