CVE-2025-36120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36120", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:18.171Z", "datePublished": "2025-08-18T13:39:41.381Z", "dateUpdated": "2026-02-26T17:48:30.436Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:storage_virtualize:8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.7:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Storage Virtualize", "vendor": "IBM", "versions": [{"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources."}], "value": "IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-18T13:39:41.381Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7240796"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, V5100 and V5000E, IBM FlashSystem 5000, 5100, 5200 and 5300, IBM FlashSystem 7200 and 7300, IBM FlashSystem 9100, 9200 and 9500 and IBM Storage Virtualize for Public Cloud to the code levels in the following table or higher using the download links for each product below the table.</p><div><table><tbody><tr><td>Affected Version(s)</td><td>Fixed Version</td></tr><tr><td>8.4.0.0-8.4.0.17</td><td>8.4.0.18</td></tr><tr><td>8.4.1.0, 8.4.2.0-8.4.2.1, 8.4.3.1</td><td>8.5.0.16</td></tr><tr><td>8.5.0.0-8.5.0.15</td><td>8.5.0.16</td></tr><tr><td>8.5.1.0, 8.5.2.0-8.5.2.3, 8.5.3.0-8.5.3.1, 8.5.4.0</td><td>8.6.0.9</td></tr><tr><td>8.6.0.0-8.6.0.8</td><td>8.6.0.9</td></tr><tr><td>8.6.1.0, 8.6.2.0-8.6.2.1, 8.6.3.0</td><td>8.7.0.6</td></tr><tr><td>8.7.0.0-8.7.0.5</td><td>8.7.0.6</td></tr><tr><td>8.7.1.0, 8.7.2.0-8.7.2.1 8.7.3.0-8.7.3.2</td><td>8.7.3.3</td></tr></tbody></table></div>\n\n<br>"}], "value": "IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, V5100 and V5000E, IBM FlashSystem 5000, 5100, 5200 and 5300, IBM FlashSystem 7200 and 7300, IBM FlashSystem 9100, 9200 and 9500 and IBM Storage Virtualize for Public Cloud to the code levels in the following table or higher using the download links for each product below the table.\n\nAffected Version(s)Fixed Version8.4.0.0-8.4.0.178.4.0.188.4.1.0, 8.4.2.0-8.4.2.1, 8.4.3.18.5.0.168.5.0.0-8.5.0.158.5.0.168.5.1.0, 8.5.2.0-8.5.2.3, 8.5.3.0-8.5.3.1, 8.5.4.08.6.0.98.6.0.0-8.6.0.88.6.0.98.6.1.0, 8.6.2.0-8.6.2.1, 8.6.3.08.7.0.68.7.0.0-8.7.0.58.7.0.68.7.1.0, 8.7.2.0-8.7.2.1 8.7.3.0-8.7.3.28.7.3.3"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Storage Virtualize privilege escalation", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-19T03:55:31.886479Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:30.436Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-18T13:56:47.700363Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T13:56:55.989Z"}}], "cna": {"title": "IBM Storage Virtualize privilege escalation", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:storage_virtualize:8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.7:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Virtualize", "versions": [{"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, V5100 and V5000E, IBM FlashSystem 5000, 5100, 5200 and 5300, IBM FlashSystem 7200 and 7300, IBM FlashSystem 9100, 9200 and 9500 and IBM Storage Virtualize for Public Cloud to the code levels in the following table or higher using the download links for each product below the table.\n\nAffected Version(s)Fixed Version8.4.0.0-8.4.0.178.4.0.188.4.1.0, 8.4.2.0-8.4.2.1, 8.4.3.18.5.0.168.5.0.0-8.5.0.158.5.0.168.5.1.0, 8.5.2.0-8.5.2.3, 8.5.3.0-8.5.3.1, 8.5.4.08.6.0.98.6.0.0-8.6.0.88.6.0.98.6.1.0, 8.6.2.0-8.6.2.1, 8.6.3.08.7.0.68.7.0.0-8.7.0.58.7.0.68.7.1.0, 8.7.2.0-8.7.2.1 8.7.3.0-8.7.3.28.7.3.3", "supportingMedia": [{"type": "text/html", "value": "<p>IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, V5100 and V5000E, IBM FlashSystem 5000, 5100, 5200 and 5300, IBM FlashSystem 7200 and 7300, IBM FlashSystem 9100, 9200 and 9500 and IBM Storage Virtualize for Public Cloud to the code levels in the following table or higher using the download links for each product below the table.</p><div><table><tbody><tr><td>Affected Version(s)</td><td>Fixed Version</td></tr><tr><td>8.4.0.0-8.4.0.17</td><td>8.4.0.18</td></tr><tr><td>8.4.1.0, 8.4.2.0-8.4.2.1, 8.4.3.1</td><td>8.5.0.16</td></tr><tr><td>8.5.0.0-8.5.0.15</td><td>8.5.0.16</td></tr><tr><td>8.5.1.0, 8.5.2.0-8.5.2.3, 8.5.3.0-8.5.3.1, 8.5.4.0</td><td>8.6.0.9</td></tr><tr><td>8.6.0.0-8.6.0.8</td><td>8.6.0.9</td></tr><tr><td>8.6.1.0, 8.6.2.0-8.6.2.1, 8.6.3.0</td><td>8.7.0.6</td></tr><tr><td>8.7.0.0-8.7.0.5</td><td>8.7.0.6</td></tr><tr><td>8.7.1.0, 8.7.2.0-8.7.2.1 8.7.3.0-8.7.3.2</td><td>8.7.3.3</td></tr></tbody></table></div>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7240796", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.", "supportingMedia": [{"type": "text/html", "value": "IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-18T13:39:41.381Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36120", "state": "PUBLISHED", "dateUpdated": "2025-08-19T03:55:31.062Z", "dateReserved": "2025-04-15T21:16:18.171Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-08-18T13:39:41.381Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:storage_virtualize:8.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize:8.7:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Storage Virtualize", "vendor": "IBM", "versions": [{"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3E519E8-37EF-4D92-A2FD-A3385E2882D2", "versionEndExcluding": "8.4.0.18", "versionStartIncluding": "8.4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "02B84B12-542E-46ED-B7E8-F3DA33F53C70", "versionEndExcluding": "8.5.0.16", "versionStartIncluding": "8.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CFABC40-3A05-4932-BDBE-44F3F764BEA6", "versionEndIncluding": "8.5.2.3", "versionStartIncluding": "8.5.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2D53C46-221F-47D6-A033-EC32F656E31D", "versionEndExcluding": "8.6.0.9", "versionStartIncluding": "8.6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "83E87C06-1327-4102-A886-81E9F175C5CE", "versionEndExcluding": "8.7.0.6", "versionStartIncluding": "8.7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DC16EC5-713E-4068-BC15-3B5E9AC2FCB2", "versionEndExcluding": "8.7.3.3", "versionStartIncluding": "8.7.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "B873D7F5-9F19-415B-B59C-7A246190FFD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "DE68C97F-22BF-40D1-BACA-C22F0BBA9F2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "070055AB-6DA7-42FD-A016-973FA1B1A297", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.4.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "F30FFE89-CA70-4D62-9724-9905AD6C715E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "CB1B622C-6334-4AA4-AF60-69AEAADF9E23", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "CAEC7842-7D7D-4D78-B017-C507DFEA11AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "AC3CD809-194E-4413-8F9A-95CB84D32171", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C50BA8E4-CB24-4AE3-BAC1-1AF4ED7D8D6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.6.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "EE7DA013-A9EC-4B48-910A-7FBF732CC911", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.6.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "018447CD-A245-458F-AF29-9BDD6FBB9D87", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "ED71E5AF-8688-4E56-90D8-C7ADE1CE639F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.6.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "186BA56B-251C-4B47-8AC4-6D5ADA615F46", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E12C7956-C1FC-41EA-A3C1-D150A703CE5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "62C74286-EE16-4DE0-B170-0928639749A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_virtualize:8.7.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "81385378-8E72-4966-9126-05CD1D65F89C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources."}, {"lang": "es", "value": "IBM Storage Virtualize 8.4, 8.5, 8.6 y 8.7 podr\u00edan permitir que un usuario autenticado aumente sus privilegios en una sesi\u00f3n SSH debido a verificaciones de autorizaci\u00f3n incorrectas para acceder a los recursos."}], "id": "CVE-2025-36120", "lastModified": "2026-06-17T09:14:30.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36120", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-19T03:55:31.886479Z", "version": "2.0.3"}}]}, "published": "2025-08-18T14:15:29.280", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7240796"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}