What is CVE-2026-4937?

CVE-2026-4937 is a medium-severity vulnerability in IBM Powervm Hypervisor, classified under Insufficient Entropy. CVSS score: 5.3/10. Published 2026-08-19.

How severe is CVE-2026-4937?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in IBM Powervm Hypervisor

CVE-2026-4937

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N.

Affected products

Ibm Powervm Hypervisor

Weakness classification (CWE)

CWE-331 — Insufficient Entropy

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-4937?: CVE-2026-4937 is a medium-severity vulnerability in IBM Powervm Hypervisor, classified under Insufficient Entropy. CVSS score: 5.3/10. Published 2026-08-19.
How severe is CVE-2026-4937?: Medium severity. CVSS v3 base score is 5.3 out of 10.