ibm Storage Virtualize vulnerabilities

Latest ibm Storage Virtualize CVEs

Newest publication first

1. CVE-2025-36118 IBM Storage Virtualize Information Disclosure

   Published 2025-11-17

   High·CVSS 7.5 EPSS 0.39%

   IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request.

2. CVE-2025-36120 IBM Storage Virtualize privilege escalation

   Published 2025-08-18

   High·CVSS 8.8 EPSS 0.33%

   IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.

3. CVE-2025-1351 IBM Storage Virtualize privilege escalation

   Published 2025-07-07

   High·CVSS 7.0 EPSS 0.10%

   IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a race condition in the login function.

4. CVE-2025-0160 IBM FlashSystem code execution

   Published 2025-02-28

   Critical·CVSS 9.8 EPSS 0.52%

   IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remo...

5. CVE-2025-0159 IBM FlashSystem authentication bypass

   Published 2025-02-28

   Critical·CVSS 9.1 EPSS 0.86%

   IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remo...

6. CVE-2024-39723 IBM FlashSystem denial of service

   Published 2024-07-08

   Medium·CVSS 4.6 EPSS 0.25%

   IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data. IBM X-Force ID: 295935.

7. CVE-2023-47700 IBM Storage Virtualize improper certificate validation

   Published 2024-02-07

   High·CVSS 7.5 EPSS 0.55%

   IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believi...

8. CVE-2023-43042 IBM Storage Virtualize information disclosure

   Published 2023-12-14

   High·CVSS 7.5 EPSS 0.72%

   IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.