CVE-2026-4932 This Power System update is being released to address Insufficient Entropy

Medium 4.2 Published 28 Jul 2026 Updated 28 Jul 2026

An attacker with physical access can decrypt encrypted memory due to insufficient cryptographic entropy in the IBM PowerVM Hypervisor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-4932?

CVE-2026-4932 is a medium-severity vulnerability in IBM PowerVM Hypervisor, published on 28 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.

Weakness: CWE-331

Which versions are affected by CVE-2026-4932?

It affects 17 products.

Products include Ibm Power System E1050 \(9043-Mrx\) Firmware, Ibm Power System E1080 \(9080-Hex\) Firmware, Ibm Power System E1150 \(9043-Mru\) Firmware, Ibm Power System E1180 \(9080-Heu\) Firmware, Ibm Power System L1022 \(9786-22h\) Firmware, Ibm Power System L1024 \(9786-42h\) Firmware and 11 more.

How do I fix CVE-2026-4932?

No fix has been published for CVE-2026-4932 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-4932 being exploited?

There is no known exploitation of CVE-2026-4932 in the wild and no public exploit code.

Sources

Also known as GHSA-4hx2-qrcw-x8xr.