CVE-2025-36255highCWE-267

CVE-2025-36255: high-severity vulnerability in IBM DS8900F ( R9.4)

DS8900F and DS8A00 Privilege Escalation

Published · Updated

Follow this CVE+ Monitor DS8900F+ Monitor DS8A00

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.4%
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · DS8900F ( R9.4)IBM · DS8A00( R10.0 - R10.1 )
Related CVEs — IBM DS8900F ( R9.4)

In the same product, most dangerous first.

CVE-2025-36192MEDIUMMissing Authorization with the DS8900F and DS8A00 Hardware Management ConsoleEPSS 0.1%