What is the CVSS score of CVE-2025-36192?

CVE-2025-36192 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM DS8000 are affected by CVE-2025-36192?

IBM DS8000 enterprise storage arrays (DS8A00 R10.0/R10.1 and DS8900F R9.4) contain an authorization flaw in Safeguarded Copy mechanisms that allows authorized operators to bypass protections and…

How to fix or mitigate CVE-2025-36192?

Within 24 hours: inventory all DS8000 systems in production and identify current firmware versions (particularly DS8A00 R10.0/R10.1 and DS8900F R9.4); document all users with CCW update permissions across your environment. Within 7 days: restrict CCW update access to a minimal set of essential roles, implement detailed audit logging on all backup snapshot modifications and deletions, and establish alerting rules for unauthorized backup changes. Within 30 days: engage IBM support to obtain patched firmware releases and establish a maintenance window for updates; evaluate interim compensating controls such as backup system segregation and implement backup integrity verification testing independent of DS8000 primary systems.

IBM DS8000 CVE-2025-36192

HIGH

Missing Authorization (CWE-862)

2025-12-26 psirt@us.ibm.com

Authentication Bypass IBM Ds8900F Firmware Ds8A00 Firmware

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Requires authenticated local access with a named low-privilege role; backup deletion yields high integrity and availability impact with no data exfiltration path and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 18:51 vuln.today

CVE Published

Dec 26, 2025 - 14:15 nvd

HIGH 7.1

DescriptionNVD

IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

AnalysisAI

IBM DS8000 enterprise storage arrays - DS8A00 (R10.0/R10.1) and DS8900F (R9.4) - expose immutable backup infrastructure to destruction by local users holding authorized CCW update permissions, due to missing authorization checks in IBM Safeguarded Copy and GDPS Logical corruption protection mechanisms. The flaw (CWE-862) allows a low-privileged operator to delete or corrupt protected backup snapshots that are specifically designed to survive ransomware and insider attacks. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the strategic risk in ransomware pre-staging scenarios is significant.

Technical ContextAI

IBM DS8000 is a high-end enterprise block storage platform serving IBM Z (mainframe) and IBM Power environments. IBM Safeguarded Copy creates firmware-enforced immutable point-in-time snapshots that ordinary storage administrators cannot delete, providing last-resort protection against ransomware and logical data corruption. GDPS (Geographically Dispersed Parallel Sysplex) Logical corruption protection extends this guarantee to disaster recovery configurations across sites. CCW (Channel Command Word) update permissions are a scoped operational role within DS8000 firmware management. CWE-862 (Missing Authorization) is the root cause: the firmware does not enforce that CCW update operations are confined to their intended functional boundary, allowing holders of that role to reach backup management functions that require higher authorization. CPE data confirms the affected components are firmware: ibm:ds8a00_firmware at versions 10.1.3.0, 10.2.45.0, and 10.10.106.0, and ibm:ds8900f_firmware at versions 89.40.83.0, 89.42.18.0, and 89.44.5.0.

RemediationAI

Consult IBM security advisory https://www.ibm.com/support/pages/node/7255039 for the specific patched firmware version applicable to your DS8A00 (R10.0/R10.1) or DS8900F (R9.4) system - the available input data does not explicitly state a fixed version number, so the advisory must be referenced directly. As a compensating control where immediate firmware update is not feasible, audit and minimize the list of accounts holding CCW update permissions to only the personnel who operationally require it, applying the principle of least privilege; removing this role from accounts that do not strictly need it eliminates the attack surface without requiring downtime. Implement enhanced audit logging and alerting on DS8000 management interfaces for any backup deletion or Safeguarded Copy modification events, enabling detection of unauthorized activity. If the DS8000 firmware version supports dual-control or separation-of-duties enforcement for Safeguarded Copy operations, enable it to require a second authorized operator for backup deletions. Note that restricting CCW update permissions may affect routine storage maintenance workflows and should be coordinated with storage operations teams.