What’s Vulnerable › Vulnerabilities
CVE-2025-36238: Power System Exposure of Sensitive System Information
- Severity: medium (CVSS 6.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-02 · updated 2026-06-17
- Weakness: CWE-497
Description
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.
Affected products
- IBM PowerVM Hypervisor: fw950.00, fw950.10, fw950.11, fw950.20, fw950.30, fw950.40 (+28)
References
Get alerted when CVE-2025-36238 or the next vulnerability affects your stack