Details of VAR-202608-7751

ID

VAR-202608-7751

CVE

CVE-2026-4936

TITLE

IBM of Power System E1050 (9043-MRX) Firmware Vulnerabilities related to entropy deficiency in multiple products such as the above.

Trust: 0.8

sources: JVNDB: JVNDB-2026-030346

DESCRIPTION

IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data. - No rewriting will occur to the information handled by the software. - The software will not stop

Trust: 1.62

sources: NVD: CVE-2026-4936 // JVNDB: JVNDB-2026-030346

AFFECTED PRODUCTS

vendor:	ibm	model:	power system s1112 \	scope:	eq	version:	fw1120.00	Trust: 2.0
vendor:	ibm	model:	power system s1112	scope:	-	version:	-	Trust: 1.6
vendor:	ibm	model:	power system s1022 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s1122 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system s1022 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s1124 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system l1024 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s924 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system l1024 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s1122 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system s1114 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system h924 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system s1122s \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system e1150 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system l1022 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system e950 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system l1022 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system h922 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system e1180 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system l1122 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system s1114 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system e1080 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system e1080 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s922 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system e1180 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system s1012 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s1012 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s1122 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system s914 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system s1014 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s924 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system s1114 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system l1124 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system e980 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system h922 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system l1124 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system s1014 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s1022s \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system h924 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system e950 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system e1050 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s1122s \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system e1150 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system e1050 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system e1180 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system l1122 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system s1124 \	scope:	eq	version:	fw1120.00	Trust: 1.0
vendor:	ibm	model:	power system s1122s \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system e1150 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system s922 \	scope:	gte	version:	fw950.00	Trust: 1.0
vendor:	ibm	model:	power system s914 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system l1122 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system e980 \	scope:	lt	version:	fw950.h3	Trust: 1.0
vendor:	ibm	model:	power system s1022s \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system s1124 \	scope:	lt	version:	fw1110.30	Trust: 1.0
vendor:	ibm	model:	power system l1124 \	scope:	gte	version:	fw1110.00	Trust: 1.0
vendor:	ibm	model:	power system s1024 \	scope:	gte	version:	fw1060.00	Trust: 1.0
vendor:	ibm	model:	power system s1024 \	scope:	lt	version:	fw1060.72	Trust: 1.0
vendor:	ibm	model:	power system l1024	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1022s	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1122s	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s924	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1024	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system l1124	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e980	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1124	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e1050	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e1080	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1122	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system l1022	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1114	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e1180	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1012	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system l1122	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system h924	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e1150	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1014	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system h922	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s1022	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s922	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system s914	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	power system e950	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2026-030346 // NVD: CVE-2026-4936

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@us.ibm.com:	CVE-2026-4936
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2026-4936
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2026-4936
value:	MEDIUM
Trust: 0.8

psirt@us.ibm.com:	CVE-2026-4936
baseSeverity:	MEDIUM
baseScore:	5.1
vectorString:	CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	0.7
impactScore:	4.0
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2026-4936
baseSeverity:	MEDIUM
baseScore:	6.2
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	CVE-2026-4936
baseSeverity:	MEDIUM
baseScore:	6.2
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-030346 // NVD: CVE-2026-4936 // NVD: CVE-2026-4936

PROBLEMTYPE DATA

problemtype:	CWE-331	Trust: 1.0
problemtype:	Lack of entropy (CWE-331) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-030346 // NVD: CVE-2026-4936

PATCH

title:

Security Bulletin

url:

https://www.ibm.com/support/pages/node/7283890

Trust: 0.8

sources: JVNDB: JVNDB-2026-030346

EXTERNAL IDS

db:	NVD	id:	CVE-2026-4936	Trust: 2.6
db:	JVNDB	id:	JVNDB-2026-030346	Trust: 0.8

sources: JVNDB: JVNDB-2026-030346 // NVD: CVE-2026-4936

REFERENCES

url:	https://www.ibm.com/support/pages/node/7283890	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-4936	Trust: 0.8

sources: JVNDB: JVNDB-2026-030346 // NVD: CVE-2026-4936

SOURCES

db:	JVNDB	id:	JVNDB-2026-030346
db:	NVD	id:	CVE-2026-4936

LAST UPDATE DATE

2026-08-27T23:58:41.479000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-030346	date:	2026-08-26T07:26:00
db:	NVD	id:	CVE-2026-4936	date:	2026-08-25T20:36:34.443

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-030346	date:	2026-08-26T00:00:00
db:	NVD	id:	CVE-2026-4936	date:	2026-08-19T21:16:55.353