Security readout for executives and security teams
Plain-English summary
A person who already controls a guest partition as root could disrupt the underlying IBM Power system. A malicious hypervisor request can permanently freeze a virtual processor, forcing a full platform restart. Limited, uncontrolled memory corruption may also occur, creating integrity risk across the managed system.
Executive priority
Prioritize remediation for shared, critical, or externally administered PowerVM environments. Although exploitation requires control of a guest as root, one compromised partition could cause managed-system disruption and a potentially significant outage requiring a full platform restart.
Technical view
Affected PowerVM firmware improperly validates a hypervisor-call value. A crafted call from a root-controlled guest can leave a virtual processor permanently unresponsive. Recovery requires a full platform re-IPL. Some cases may inject a small amount of data into hypervisor or partition memory, although the attacker cannot choose the destination.
Likely exposure
Exposure is limited to IBM PowerVM systems running FW1120.00, FW1110.00–FW1110.30, FW1060.00–FW1060.80, or FW950.00–FW950.H2. Exploitation requires root access within a guest partition, so compromised guests and environments granting guest administration to less-trusted parties carry the greatest risk.
Exploitation context
The source bundle reports that this CVE is not in KEV and provides no evidence of active exploitation. The attack is local from a guest partition and requires guest root access. Its principal consequence is platform-level denial of service, with a smaller uncontrolled memory-integrity impact.
Researcher notes
CWE-129 and the CVSS 3.1 vector indicate improper validation at a local, privileged guest-to-hypervisor boundary. Scope changes because effects reach the managed system beyond the initiating guest. Available sources describe limited memory modification but explicitly state that the attacker cannot control its destination.
Mitigation direction
- Inventory Power systems and compare their exact firmware levels with the IBM advisory.
- Apply IBM's firmware update specified for each affected PowerVM firmware branch.
- Until updated, tightly restrict and monitor root access within guest partitions.
- Plan maintenance and recovery procedures for a possible full-platform re-IPL.
Validation and detection
- Record the exact system firmware level for every PowerVM-managed system.
- Identify systems within the affected firmware ranges stated in the IBM advisory.
- After maintenance, verify installed firmware against IBM's documented corrected levels.
- Review guest-root access and relevant monitoring records for suspicious hypervisor-related activity.
- Do not reproduce the condition on production systems because recovery may require a platform restart.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-129: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-17097 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H24.7ibmVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7283231CVE reference, ibm · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Array Index
Improper Validation of Array Index represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.