CVE-2025-36104: IBM Storage Scale Information Disclosure

CVE-2025-36104 Overview

IBM Storage Scale versions 5.2.3.0 and 5.2.3.1 contain an insecure permissions flaw that allows authenticated users to access sensitive file contents through the Server Message Block (SMB) protocol. The vulnerability stems from files inheriting overly permissive access rights when served via SMB shares. An authenticated attacker with network access can read files they should not be authorized to view. IBM has published a security advisory documenting the issue and providing remediation guidance.

Critical Impact
Authenticated network users can read sensitive file contents from IBM Storage Scale SMB shares, resulting in confidentiality loss across affected file systems.

Affected Products

IBM Storage Scale 5.2.3.0
IBM Storage Scale 5.2.3.1
Deployments exposing SMB protocol access

Discovery Timeline

2025-07-12 - CVE-2025-36104 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36104

Vulnerability Analysis

The flaw is classified under [CWE-277] Insecure Inherited Permissions and [CWE-732] Incorrect Permission Assignment for Critical Resource. Files served through the SMB protocol in IBM Storage Scale inherit access permissions that do not enforce the intended access boundaries. Authenticated users connecting to SMB shares can therefore read files whose contents should remain restricted.

IBM Storage Scale is a clustered file system used for high-performance storage in enterprise and research environments. When SMB export is enabled, the mismatch between file system Access Control Lists (ACLs) and inherited SMB permissions creates a confidentiality exposure. The scope is limited to information disclosure. Integrity and availability are not affected based on the published CVSS vector.

Root Cause

The root cause is improper enforcement of permission inheritance semantics between the underlying file system and the SMB protocol layer. Newly created or accessed files inherit permissions that grant broader read access than the administrator intended. The defect is present in the SMB export logic of the affected 5.2.3.x release train.

Attack Vector

Exploitation requires an authenticated user account with SMB access to the Storage Scale cluster. No user interaction and no elevated privileges are required beyond an existing low-privileged account. The attacker connects over the network to an SMB share and reads files whose ACLs should have restricted access. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code exists for this vulnerability. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2025-36104

Indicators of Compromise

Unexpected SMB read operations against sensitive shares performed by non-administrative accounts
Access log entries showing users successfully opening files outside their business scope
Bulk file enumeration or recursive directory reads from a single authenticated SMB session

Detection Strategies

Audit SMB share permissions and file ACLs on Storage Scale exports to identify permission drift
Compare effective SMB permissions against intended file system ACLs using IBM Storage Scale management tooling
Correlate authentication events with SMB file-open events to flag anomalous read patterns

Monitoring Recommendations

Enable SMB audit logging on Storage Scale cluster nodes and forward logs to a centralized analytics platform
Alert on high-volume file read operations from individual user sessions targeting sensitive directories
Review privileged and service account SMB activity on a recurring cadence

How to Mitigate CVE-2025-36104

Immediate Actions Required

Identify all IBM Storage Scale nodes running versions 5.2.3.0 or 5.2.3.1
Apply the fix documented in the IBM Support Page
Review SMB share ACLs and remove unintended inherited read permissions on sensitive files
Rotate credentials for accounts that may have been used to access exposed data

Patch Information

IBM has published remediation guidance for CVE-2025-36104 on the IBM Support Page. Administrators should follow the vendor advisory to obtain the fix pack and apply it to all affected 5.2.3.x deployments.

Workarounds

Restrict SMB share access to a minimum set of authenticated users pending patch deployment
Explicitly set restrictive ACLs on sensitive directories rather than relying on inherited permissions
Disable SMB export on Storage Scale file systems that do not require it until the patch is applied

bash

# Review effective ACLs on a Storage Scale file or directory before and after patching
mmgetacl /gpfs/fs1/sensitive_directory

# Apply a restrictive ACL that does not rely on inheritance
mmputacl -i restricted_acl.txt /gpfs/fs1/sensitive_directory