{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4936", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-03-26T20:32:20.576Z", "datePublished": "2026-08-19T20:14:55.609Z", "dateUpdated": "2026-08-20T13:29:02.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-19T20:14:55.609Z"}, "title": "Power System Insufficient Entropy", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-331", "description": "CWE-331 Insufficient Entropy", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "PowerVM Hypervisor", "versions": [{"status": "affected", "version": "FW1110.00", "lessThanOrEqual": "FW1110.20", "versionType": "semver"}, {"status": "affected", "version": "FW1060.00", "lessThanOrEqual": "FW1060.71", "versionType": "semver"}, {"status": "affected", "version": "FW950.00", "lessThanOrEqual": "FW950.H2", "versionType": "semver"}], "cpes": ["cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283890", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\n\n\n\nBefore issuing the resource dump, confirm all of the following:\n\n * The system is at runtime.\n * There are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).\n * There are no unresolved action-required PEL entries.\n * The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\n\n\n\n\nThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\n\n\n\nHMC-attached systems : \u00a0 https://www.ibm.com/support/pages/node/667943 \n\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\nFSP-based standalone systems:\n\n * Log onto the system ASM with admin credentials\n * Navigate to System Service Aids -> Resource Dump\n * Initiate the resource dump\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nBMC-based standalone systems:\n\n * Log onto the system ASMi with admin credentials\n * Navigate to Logs and Services -> Dumps -> Select a dump -> Resource Dump\n * Initiate the resource dump:\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nFor HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\n\n\n\nTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\n\n * HMC CLI (SSH):\u00a0ls -ltr\u00a0/dump/RSCDUMP.*\n * Validate the Serial Number and date of dump.\n\n\n\n\nOnce the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\n\n\n\nFor standalone servers, the resource dump will be uploaded to the Operating System.\n\n * Linux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.\n * IBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\n * AIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021\n\n\n\n\nLastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.</p><p>Before issuing the resource dump, confirm all of the following:</p><ul><li>The system is at runtime.</li><li>There are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).</li><li>There are no unresolved action-required PEL entries.</li><li>The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.</li></ul><p>The required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:</p><p>HMC-attached systems : \u00a0<a href=\"https://www.ibm.com/support/pages/node/667943\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/667943</a></p><ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul><p>FSP-based standalone systems:</p><ul><li>Log onto the system ASM with admin credentials</li><li>Navigate to System Service Aids -&gt; Resource Dump</li><li>Initiate the resource dump\n<ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul></li></ul><p>BMC-based standalone systems:</p><ul><li>Log onto the system ASMi with admin credentials</li><li>Navigate to Logs and Services -&gt; Dumps -&gt; Select a dump -&gt; Resource Dump</li><li>Initiate the resource dump:\n<ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul></li></ul><p>For <strong>HMC managed systems,</strong> after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.</p><p>To monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:</p><ul><li>HMC CLI (SSH):\u00a0<em>ls -ltr\u00a0/dump/RSCDUMP.*</em></li><li>Validate the Serial Number and date of dump.</li></ul><p>Once the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.</p><p>For <strong>standalone servers</strong>, the resource dump will be uploaded to the Operating System.</p><ul><li>Linux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0<strong>/var/log/dump/</strong>. A B7009021 would present as a permanent error in the PPC64 platform log file.</li><li>IBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0<strong>Main Storage Dump Manager</strong> in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.</li><li>AIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0<strong>/var/adm/ras/platform/</strong>. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021</li></ul><p><strong>Lastly:</strong> Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.</p>"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System E1180 (9080-HEU)\n\n\nCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System S1122 (9824-22A)\n * IBM Power System S1124 (9824-42A)\n * IBM Power System S1122s (9824-22B)\n * IBM Power System S1114 (9824-41B)\n * IBM Power System L1122 (9856-22H)\n * IBM Power System L1124 (9856-42H)\n * IBM Power System E1150 (9043-MRU)\n\n\nCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\n\n\n\nPower 11\n\n * IBM Power System S1112 (9242-21B, 9242-21T)\n\n\n\nCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System E1080 (9080-HEX)\n\n\nCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System S1022 (9105-22A)\n * IBM Power System S1024 (9105-42A)\n * IBM Power System S1022s (9105-22B)\n * IBM Power System S1014 (9105-41B)\n * IBM Power System L1022 (9786-22H)\n * IBM Power System L1024 (9786-42H)\n * IBM Power System E1050 (9043-MRX)\n * IBM Power System S1012 (9028-21B)\n\n\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\nPower 9\n\n * IBM Power System S922 (9009-22G)\n * IBM Power System H922 (9223-22S)\n * IBM Power System S914 (9009-41G)\n * IBM Power System S924 (9009-42G)\n * IBM Power System H924 (9223-42S)\n * IBM Power System E950 (9040-MR9)\n * IBM Power System E980 (9080-M9S)\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.<br/>Power 11</p><ol><li>IBM Power System E1180 (9080-HEU)</li></ol><p>Customers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.<br/>Power 11</p><ol><li>IBM Power System S1122 (9824-22A)</li><li>IBM Power System S1124 (9824-42A)</li><li>IBM Power System S1122s (9824-22B)</li><li>IBM Power System S1114 (9824-41B)</li><li>IBM Power System L1122 (9856-22H)</li><li>IBM Power System L1124 (9856-42H)</li><li>IBM Power System E1150 (9043-MRU)</li></ol><p>Customers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.</p><p>Power 11</p><ol><li>IBM Power System S1112 (9242-21B, 9242-21T)</li></ol><p><br/>Customers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System E1080 (9080-HEX)</li></ol><p>Customers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System S1022 (9105-22A)</li><li>IBM Power System S1024 (9105-42A)</li><li>IBM Power System S1022s (9105-22B)</li><li>IBM Power System S1014 (9105-41B)</li><li>IBM Power System L1022 (9786-22H)</li><li>IBM Power System L1024 (9786-42H)</li><li>IBM Power System E1050 (9043-MRX)</li><li>IBM Power System S1012 (9028-21B)</li></ol><p>Customers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.<br/>Power 9</p><ol><li>IBM Power System S922 (9009-22G)</li><li>IBM Power System H922 (9223-22S)</li><li>IBM Power System S914 (9009-41G)</li><li>IBM Power System S924 (9009-42G)</li><li>IBM Power System H924 (9223-42S)</li><li>IBM Power System E950 (9040-MR9)</li><li>IBM Power System E980 (9080-M9S)</li></ol><p><em>The images mentioned above can be located at IBM Fix Central : </em><a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"><em>https://www.ibm.com/support/fixcentral/</em></a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T13:28:12.630911Z", "id": "CVE-2026-4936", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:29:02.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T13:28:12.630911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:28:55.531Z"}}], "cna": {"title": "Power System Insufficient Entropy", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "PowerVM Hypervisor", "versions": [{"status": "affected", "version": "FW1110.00", "versionType": "semver", "lessThanOrEqual": "FW1110.20"}, {"status": "affected", "version": "FW1060.00", "versionType": "semver", "lessThanOrEqual": "FW1060.71"}, {"status": "affected", "version": "FW950.00", "versionType": "semver", "lessThanOrEqual": "FW950.H2"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System E1180 (9080-HEU)\n\n\nCustomers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.\nPower 11\n\n * IBM Power System S1122 (9824-22A)\n * IBM Power System S1124 (9824-42A)\n * IBM Power System S1122s (9824-22B)\n * IBM Power System S1114 (9824-41B)\n * IBM Power System L1122 (9856-22H)\n * IBM Power System L1124 (9856-42H)\n * IBM Power System E1150 (9043-MRU)\n\n\nCustomers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.\n\n\n\nPower 11\n\n * IBM Power System S1112 (9242-21B, 9242-21T)\n\n\n\nCustomers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System E1080 (9080-HEX)\n\n\nCustomers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.\nPower 10\n\n * IBM Power System S1022 (9105-22A)\n * IBM Power System S1024 (9105-42A)\n * IBM Power System S1022s (9105-22B)\n * IBM Power System S1014 (9105-41B)\n * IBM Power System L1022 (9786-22H)\n * IBM Power System L1024 (9786-42H)\n * IBM Power System E1050 (9043-MRX)\n * IBM Power System S1012 (9028-21B)\n\n\nCustomers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.\nPower 9\n\n * IBM Power System S922 (9009-22G)\n * IBM Power System H922 (9223-22S)\n * IBM Power System S914 (9009-41G)\n * IBM Power System S924 (9009-42G)\n * IBM Power System H924 (9223-42S)\n * IBM Power System E950 (9040-MR9)\n * IBM Power System E980 (9080-M9S)\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "value": "<p>Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.<br/>Power 11</p><ol><li>IBM Power System E1180 (9080-HEU)</li></ol><p>Customers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.<br/>Power 11</p><ol><li>IBM Power System S1122 (9824-22A)</li><li>IBM Power System S1124 (9824-42A)</li><li>IBM Power System S1122s (9824-22B)</li><li>IBM Power System S1114 (9824-41B)</li><li>IBM Power System L1122 (9856-22H)</li><li>IBM Power System L1124 (9856-42H)</li><li>IBM Power System E1150 (9043-MRU)</li></ol><p>Customers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.</p><p>Power 11</p><ol><li>IBM Power System S1112 (9242-21B, 9242-21T)</li></ol><p><br/>Customers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System E1080 (9080-HEX)</li></ol><p>Customers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.<br/>Power 10</p><ol><li>IBM Power System S1022 (9105-22A)</li><li>IBM Power System S1024 (9105-42A)</li><li>IBM Power System S1022s (9105-22B)</li><li>IBM Power System S1014 (9105-41B)</li><li>IBM Power System L1022 (9786-22H)</li><li>IBM Power System L1024 (9786-42H)</li><li>IBM Power System E1050 (9043-MRX)</li><li>IBM Power System S1012 (9028-21B)</li></ol><p>Customers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.<br/>Power 9</p><ol><li>IBM Power System S922 (9009-22G)</li><li>IBM Power System H922 (9223-22S)</li><li>IBM Power System S914 (9009-41G)</li><li>IBM Power System S924 (9009-42G)</li><li>IBM Power System H924 (9223-42S)</li><li>IBM Power System E950 (9040-MR9)</li><li>IBM Power System E980 (9080-M9S)</li></ol><p><em>The images mentioned above can be located at IBM Fix Central : </em><a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"><em>https://www.ibm.com/support/fixcentral/</em></a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283890", "tags": ["vendor-advisory", "patch"]}], "workarounds": [{"lang": "en", "value": "Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.\n\n\n\nBefore issuing the resource dump, confirm all of the following:\n\n * The system is at runtime.\n * There are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).\n * There are no unresolved action-required PEL entries.\n * The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.\n\n\n\n\nThe required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:\n\n\n\nHMC-attached systems : \u00a0 https://www.ibm.com/support/pages/node/667943 \n\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\nFSP-based standalone systems:\n\n * Log onto the system ASM with admin credentials\n * Navigate to System Service Aids -> Resource Dump\n * Initiate the resource dump\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nBMC-based standalone systems:\n\n * Log onto the system ASMi with admin credentials\n * Navigate to Logs and Services -> Dumps -> Select a dump -> Resource Dump\n * Initiate the resource dump:\n * Use selector: sbmgr -regenerateKeys\n\n\n\n\n\n\n\nFor HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.\n\n\n\nTo monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:\n\n * HMC CLI (SSH):\u00a0ls -ltr\u00a0/dump/RSCDUMP.*\n * Validate the Serial Number and date of dump.\n\n\n\n\nOnce the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.\n\n\n\nFor standalone servers, the resource dump will be uploaded to the Operating System.\n\n * Linux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.\n * IBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.\n * AIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0/var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021\n\n\n\n\nLastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.", "supportingMedia": [{"type": "text/html", "value": "<p>Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.</p><p>Before issuing the resource dump, confirm all of the following:</p><ul><li>The system is at runtime.</li><li>There are no outstanding recovery actions (the system must not be in \"Recovery\" state on the HMC).</li><li>There are no unresolved action-required PEL entries.</li><li>The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.</li></ul><p>The required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:</p><p>HMC-attached systems : \u00a0<a href=\"https://www.ibm.com/support/pages/node/667943\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/667943</a></p><ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul><p>FSP-based standalone systems:</p><ul><li>Log onto the system ASM with admin credentials</li><li>Navigate to System Service Aids -&gt; Resource Dump</li><li>Initiate the resource dump\n<ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul></li></ul><p>BMC-based standalone systems:</p><ul><li>Log onto the system ASMi with admin credentials</li><li>Navigate to Logs and Services -&gt; Dumps -&gt; Select a dump -&gt; Resource Dump</li><li>Initiate the resource dump:\n<ul><li>Use selector: <em><strong>sbmgr -regenerateKeys</strong></em></li></ul></li></ul><p>For <strong>HMC managed systems,</strong> after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.</p><p>To monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:</p><ul><li>HMC CLI (SSH):\u00a0<em>ls -ltr\u00a0/dump/RSCDUMP.*</em></li><li>Validate the Serial Number and date of dump.</li></ul><p>Once the dump has offloaded to the HMC, check in the HMC\u2019s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.</p><p>For <strong>standalone servers</strong>, the resource dump will be uploaded to the Operating System.</p><ul><li>Linux: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0<strong>/var/log/dump/</strong>. A B7009021 would present as a permanent error in the PPC64 platform log file.</li><li>IBM i: Server level dumps, including Resource Dumps, will be copied into the\u00a0<strong>Main Storage Dump Manager</strong> in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.</li><li>AIX: Server level dumps, including Resource Dumps, will be placed in directory:\u00a0<strong>/var/adm/ras/platform/</strong>. A B7009021 would present Permanent sysplanar error in the errpt.\u00a0 IBM Service may be needed to determine if the event is a B7009021</li></ul><p><strong>Lastly:</strong> Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331 Insufficient Entropy"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-19T20:14:55.609Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4936", "state": "PUBLISHED", "dateUpdated": "2026-08-20T13:29:02.461Z", "dateReserved": "2026-03-26T20:32:20.576Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-08-19T20:14:55.609Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:ibm:power_systems_firmware:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1110.20:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw1060.71:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*"], "product": "PowerVM Hypervisor", "vendor": "IBM", "versions": [{"lessThanOrEqual": "FW1110.20", "status": "affected", "version": "FW1110.00", "versionType": "semver"}, {"lessThanOrEqual": "FW1060.71", "status": "affected", "version": "FW1060.00", "versionType": "semver"}, {"lessThanOrEqual": "FW950.H2", "status": "affected", "version": "FW950.00", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data."}], "id": "CVE-2026-4936", "lastModified": "2026-08-20T14:17:13.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 4.0, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4936", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T13:28:12.630911Z", "version": "2.0.3"}}]}, "published": "2026-08-19T21:16:55.353", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7283890"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-331"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}