IBM DS8900F Firmware vulnerabilities

9 CVEs affecting IBM DS8900F Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36398, published 2026-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-46169, published 2024-03-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406.
CVE-2023-46172, published 2024-03-07. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass authentication restrictions for authorized user. IBM X-Force ID: 269409.
CVE-2025-36254, published 2026-08-19. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI…
CVE-2023-46170, published 2024-03-07. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names.
CVE-2024-22326, published 2024-06-06. Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create an LDAP connection with a valid username and empty password…
CVE-2023-46171, published 2024-03-07. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to view sensitive log information after enumerating filenames. IBM X-Force ID: …
CVE-2025-36398, published 2026-08-19. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an…
CVE-2025-36255, published 2026-08-19. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper…
CVE-2025-36192, published 2025-12-26. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW…