How severe is CVE-2025-36255?

CVE-2025-36255 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-36255 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-36255?

CVE-2025-36255 primarily affects Ibm Ds8900f Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-36255?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2025-36255 published?

CVE-2025-36255 was published on 2026-08-19 and last updated on 2026-09-29.

CVE-2025-36255

CVE-2025-36255 is a high-severity vulnerability in Ibm Ds8900f Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-267.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-267
Affected product: Ibm Ds8900f Firmware
Published: 2026-08-19
Last modified: 2026-09-29

Description

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.

Frequently asked questions

What is CVE-2025-36255?: IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
How severe is CVE-2025-36255?: CVE-2025-36255 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-36255 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-36255?: CVE-2025-36255 primarily affects Ibm Ds8900f Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-36255?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2025-36255 published?: CVE-2025-36255 was published on 2026-08-19 and last updated on 2026-09-29.

References

https://www.ibm.com/support/pages/node/7284322

Affected products (2)

cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Ibm Ds8900f Firmware

CVE-2025-36254 — High (CVSS 7.4): IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an…
CVE-2025-36192 — Medium (CVSS 6.7): IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4)…
CVE-2023-46170 — Medium (CVSS 6.5): IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to…
CVE-2023-46169 — Medium (CVSS 6.5): IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to…
CVE-2023-46172 — Medium (CVSS 5.6): IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass…
CVE-2025-36398 — Medium (CVSS 5.4): IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an…

All CVEs affecting Ibm Ds8900f Firmware →

Other CWE-267 vulnerabilities

CVE-2023-22647 — Critical (CVSS 9.9): An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing…
CVE-2026-29646 — Critical (CVSS 9.8): In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to…
CVE-2026-96659 — Critical (CVSS 9.1): A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause…
CVE-2021-44547 — Critical (CVSS 9.1): A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed…
CVE-2026-10090 — Critical (CVSS 9.0): A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced…
CVE-2026-18951 — High (CVSS 8.8): A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly…

Browse all CWE-267 vulnerabilities →