CVE-2025-36238

moderate-risk

Published 2026-02-02

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

Do I need to act?

-

0.01% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

6

CVSS 6.0/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Powervm Hypervisor

Affected Vendors

Ibm

References (1)

Vendor Advisory https://www.ibm.com/support/pages/node/7257556

43

/ 100

moderate-risk

Severity 20/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 23/34 · High