IBM Storage Virtualize vulnerabilities

8 CVEs affecting IBM Storage Virtualize, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36118, published 2025-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-0159, published 2025-02-28. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1,…
CVE-2023-43042, published 2023-12-14. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.
CVE-2023-47700, published 2024-02-07. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the…
CVE-2025-0160, published 2025-02-28. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1,…
CVE-2025-36118, published 2025-11-17. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request.
CVE-2025-36120, published 2025-08-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.
CVE-2024-39723, published 2024-07-08. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data.…
CVE-2025-1351, published 2025-07-07. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a race condition in the login function.