CVE-2025-0160: IBM Storage Virtualize

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.

Affected products

• IBM Storage Virtualize: from 8.5, before 8.5.0.14 (fixed in 8.5.0.14); from 8.5.2.0, up to and including 8.5.2.3; from 8.6.0.0, before 8.6.0.6 (fixed in 8.6.0.6); from 8.7.0.0, before 8.7.0.3 (fixed in 8.7.0.3); version 8.5.1.0 only; version 8.5.3.0 only; …

Published 2025-02-28. Last modified 2026-06-17.