What is the CVSS score of CVE-2025-3319?

CVE-2025-3319 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spectrum Protect Server are affected by CVE-2025-3319?

CVE-2025-3319 affects IBM Spectrum Protect Server versions 8.1 through 8.1.26, allowing attackers to bypass authentication and access unauthorized resources without a patch currently available.

How to fix or mitigate CVE-2025-3319?

Within 24 hours: Identify and inventory all IBM Spectrum Protect Server instances running versions 8.1-8.1.26 and restrict network access to trusted administrator sources only. Within 7 days: Implement enhanced monitoring and logging for authentication anomalies; review recent access logs for suspicious session activity. Within 30 days: Upgrade to version 8.1.27 or later once patches are released, or evaluate migration to alternative backup solutions if patching is delayed.

Spectrum Protect Server CVE-2025-3319

EUVD-2025-18753 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-06-20 psirt@us.ibm.com

IBM Authentication Bypass Spectrum Protect Server

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18753

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.

AnalysisAI

CVE-2025-3319 is an authentication bypass vulnerability in IBM Spectrum Protect Server versions 8.1 through 8.1.26 caused by improper session authentication mechanisms. This flaw allows unauthenticated network attackers to bypass authentication and gain unauthorized access to protected resources, potentially compromising backup and recovery infrastructure. With a CVSS score of 8.1 (High) and network-based attack vector, this vulnerability poses significant risk to organizations relying on Spectrum Protect for data protection.

Technical ContextAI

IBM Spectrum Protect Server is a centralized backup and recovery platform (CPE: cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:*). The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), indicating that the session authentication handler fails to properly validate user credentials or session tokens before granting access to critical resources. The affected versions (8.1.x through 8.1.26) contain flawed session validation logic in the authentication layer, likely in the server's administrative or client communication interfaces. This is not a cryptographic weakness but rather a logic flaw where the application assumes authenticated status without proper verification, potentially allowing attackers to craft requests that bypass session checks entirely or reuse/forge session identifiers.

RemediationAI

Upgrade IBM Spectrum Protect Server to version 8.1.27 or later; priority: Critical; details: Apply the latest patch from IBM's security update repository. Verify compatibility with current backup policies and client versions before deployment. Workaround: Network segmentation; priority: High (if patching delayed); details: Restrict network access to Spectrum Protect Server administrative interfaces to trusted networks only. Implement firewall rules limiting inbound connections to management ports (default: 1500-1501 for client communication, additional administrative ports). Workaround: Monitor session activity; priority: Medium; details: Enable verbose logging on session authentication attempts. Monitor for unusual session tokens, failed authentication patterns, or requests from unexpected sources. Check audit logs for unauthorized resource access. Detection: IDS/IPS signatures; priority: High; details: Deploy detection rules for anomalous session validation bypass attempts against Spectrum Protect ports. Coordinate with IBM security team for specific indicators of compromise.