Vulnerability · Published Aug 19, 2026 · Assigned by ibm
CVE-2025-36255DS8900F and DS8A00 Privilege Escalation
High 7.5
In plain English
A high-severity security flaw in DS8900F ( R9.4) from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | DS8A00( R10.0 - R10.1 ) | 10.1.3.0 – through 10.11.35.0 |
| IBM | DS8900F ( R9.4) | 89.40.83.0 – through 89.44.25.0 |
Weakness: CWE-267 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.ibm.com/support/pages/node/7284322 vendor-advisory, patch