CVE-2025-0160: high-severity vulnerability in IBM Storage Virtualize
IBM FlashSystem code execution
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.5%
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · Storage VirtualizeRelated CVEs — IBM Storage Virtualize
In the same product, most dangerous first.
CVE-2025-0159CRITICALIBM FlashSystem authentication bypassEPSS 0.9%CVE-2023-43042HIGHIBM Storage Virtualize information disclosureEPSS 0.7%CVE-2023-47700MEDIUMIBM Storage Virtualize improper certificate validationEPSS 0.5%CVE-2025-36118HIGHIBM Storage Virtualize Information DisclosureEPSS 0.4%CVE-2025-36120HIGHIBM Storage Virtualize privilege escalationEPSS 0.3%CVE-2024-39723MEDIUMIBM FlashSystem denial of serviceEPSS 0.2%