IBM Spectrum Protect Server vulnerabilities

5 CVEs affecting IBM Spectrum Protect Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-3319, published 2025-06-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22487, published 2022-06-30. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID.…
CVE-2022-22496, published 2022-06-30. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be…
CVE-2018-1788, published 2018-11-02. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873.
CVE-2025-3319, published 2025-06-20. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.
CVE-2020-4591, published 2020-08-28. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted…