IBM DS8000 CVE-2025-36192

Exploitation requires an authenticated local account on the IBM DS8000 management system that holds the specifically named 'authorized CCW update permissions' role - generic authenticated users without this role are not affected. The vulnerability is only present in DS8000 deployments where IBM Safeguarded Copy or GDPS Logical corruption protection is actively configured; systems not using these features have no exposure from this flaw. The CVSS PR:L metric confirms authentication with this specific role is mandatory for exploitation. The CVSS AV:L (Local) vector indicates no unauthenticated network-facing exploitation path exists - the attacker must have credentialed access to the storage management environment. Exploitation is further bounded to the DS8A00 and DS8900F model lines at the specific firmware versions listed; other DS8000 variants or firmware releases are not confirmed affected by available data.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 7.1) is internally consistent with the vulnerability description: local access with a specific low-privilege role is required, exploitation is straightforward once that role is held, and the impact is confined to backup integrity and availability with no data exfiltration path. No EPSS score was provided in the input data, leaving exploitation probability unquantified; no CISA KEV listing and no public POC further suggest opportunistic mass exploitation is not occurring. However, the raw CVSS score understates strategic risk: Safeguarded Copy exists precisely to guarantee recovery from ransomware and insider sabotage, and an adversary who first compromises a CCW update account could silently destroy all recovery points before deploying destructive payloads, leaving an organization with no immutable restore option. The threat is most credible in insider-threat and post-compromise lateral movement scenarios targeting large mainframe or financial-sector environments where DS8000 arrays underpin critical workloads. No conflicts exist between the CVSS vector and the description; both consistently point to a local, authenticated, low-privilege attack on backup protection mechanisms.

An insider or an adversary who has compromised a storage operator account with CCW update permissions authenticates to the DS8000 management interface. Exploiting the missing authorization boundary, the attacker issues backup management commands outside the intended scope of the CCW role to delete or corrupt all Safeguarded Copy snapshots. With immutable recovery points eliminated, the attacker or a coordinated ransomware actor proceeds to encrypt or destroy primary data, leaving the organization without a clean restore path.