What is the CVSS score of CVE-2025-36254?

CVE-2025-36254 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM DS8000 Storage are affected by CVE-2025-36254?

IBM System Storage arrays DS8A00 and DS8900F are vulnerable to unauthenticated management interface bypass (CVE-2025-36254), exposing sensitive storage configuration data and system control to any…. A patch is available.

How to fix or mitigate CVE-2025-36254?

Within 24 hours, identify and inventory all IBM DS8A00 storage arrays running firmware versions 10.1.3.0 through 10.11.35.0 and DS8900F systems running firmware 89.40.83.0 through 89.44.25.0. Consult IBM's security advisory for the specific patched firmware versions and begin the patch deployment process, starting with test systems to validate compatibility. Within 7 days, complete full patching of all affected production arrays using the vendor-released patches per IBM's advisory, adhering to your established change management procedures. Within 30 days, validate successful patch deployment across all systems, review storage management interface access logs for any suspicious activity during the vulnerability exposure window, and establish processes for timely patching of future firmware updates.

IBM DS8000 Storage CVE-2025-36254

EUVD-2025-210745 HIGH

Improper Encoding or Escaping of Output (CWE-116)

2026-08-19 ibm

GHSA-r4hf-3hxr-r742

Denial Of Service IBM Ds8A00 R10 0 R10 1 Ds8900F R9 4

7.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.4 HIGH

Network-accessible DSCLI interface with no prior auth needed; AC:H reflects specific encoding conditions required to trigger bypass; no integrity impact per description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 22:17 vuln.today

CVE Published

Aug 19, 2026 - 21:22 cve.org

HIGH 7.4

DescriptionCVE.org

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

AnalysisAI

Authentication bypass in IBM System Storage DS8A00 (firmware 10.1.3.0-10.11.35.0) and DS8900F (firmware 89.40.83.0-89.44.25.0) exposes enterprise storage array management interfaces to network-reachable attackers who can circumvent security controls without valid credentials, enabling exfiltration of sensitive management data or availability disruption. The root cause is CWE-116 (Improper Encoding or Escaping of Output) in DSCLI command output processing, where encoding defects allow authentication logic to be bypassed. No public exploit code has been identified at time of analysis, and a vendor patch is available via IBM's security advisory.

Technical ContextAI

The DS Command-Line Interface (DSCLI) is IBM's management CLI for the DS8000 family of enterprise block storage arrays, used in large data centers and mainframe environments. The affected products are identified by CPE strings cpe:2.3:a:ibm:ds8a00_(r10.0_-_r10.1) and cpe:2.3:a:ibm:ds8900f_(r9.4), covering the R10.0-R10.1 and R9.4 release streams respectively. CWE-116 (Improper Encoding or Escaping of Output) describes a class of flaws where output data is not correctly encoded before being passed to a downstream consumer, causing that consumer to misinterpret security-relevant tokens or delimiters. In this case, DSCLI command output encoding defects propagate into the authentication evaluation layer, where misinterpreted tokens allow the access control check to be bypassed - a pattern where the encoding flaw effectively poisons the trust boundary between the CLI output subsystem and the security enforcement logic.

RemediationAI

The primary remediation is to apply the vendor-released patch available from IBM per advisory https://www.ibm.com/support/pages/node/7284322. The exact patched firmware version numbers are not disclosed in the provided references; consult the IBM advisory directly to identify the target release for your product line (DS8A00 R10.x or DS8900F R9.4) and follow IBM's firmware upgrade procedure. As a compensating control pending patching, isolate all DS8000 storage management interfaces - including DSCLI endpoints - on a dedicated, firewalled management VLAN not reachable from untrusted or general-purpose networks; this directly neutralizes the AV:N attack vector and prevents unauthenticated network exploitation even before the patch is applied. Note that VLAN segmentation reduces exposure but does not eliminate the vulnerability for insider-threat or lateral-movement scenarios. Additionally, review DSCLI access logs for anomalous unauthenticated or low-fidelity authentication events that may indicate exploitation attempts.