CVE-2026-4936

MediumCVSS 6.2/10Last modified Aug 25, 2026

Description

IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Aug 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-493607.8Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose CVE-2026-493617.5Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, al CVE-2026-493627.5An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulat CVE-2026-493637.5An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY reque CVE-2026-493649.1An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster CVE-2026-493655.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP CVE-2026-493667.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion CVE-2026-493678.8In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account CVE-2026-493685.4In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible CVE-2026-493694.3In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages CVE-2026-49376.0IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker CVE-2026-493707.5In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests