CVE-2025-36120: IBM Storage Virtualize Privilege Escalation

CVE-2025-36120 Overview

CVE-2025-36120 is a privilege escalation vulnerability in IBM Storage Virtualize versions 8.4, 8.5, 8.6, and 8.7. An authenticated user can escalate privileges through an SSH session due to incorrect authorization checks when accessing internal resources. The flaw is classified under [CWE-863] Incorrect Authorization. Successful exploitation grants attackers elevated control over the storage management plane, putting confidentiality, integrity, and availability of stored data at risk.

Critical Impact

An authenticated attacker with low privileges can escalate to higher privileges over SSH, gaining administrative control of IBM Storage Virtualize systems that manage enterprise storage infrastructure.

Affected Products

• IBM Storage Virtualize 8.4 (including 8.4.1.0, 8.4.2.0, 8.4.2.1, 8.4.3.1)
• IBM Storage Virtualize 8.5 (including 8.5.1.0, 8.5.3.0, 8.5.3.1, 8.5.4.0)
• IBM Storage Virtualize 8.6 and 8.7 (including 8.6.1.0–8.6.3.0 and 8.7.1.0–8.7.2.1)

Discovery Timeline

• 2025-08-18 - CVE-2025-36120 published to NVD
• 2025-08-21 - Last updated in NVD database

Technical Details for CVE-2025-36120

Vulnerability Analysis

The vulnerability resides in the SSH session handling layer of IBM Storage Virtualize. Authorization checks fail to correctly validate whether an authenticated user has permission to access certain resources or invoke specific commands. As a result, a user with limited privileges can perform actions reserved for administrative roles. The attack vector is network-based and requires only low privileges with no user interaction, making it exploitable by any account with SSH access to the management interface.

IBM Storage Virtualize underpins products such as IBM FlashSystem and SAN Volume Controller. Compromise of the management plane can expose volume configurations, replication policies, and tenant data across the storage fabric.

Root Cause

The root cause is improper authorization enforcement [CWE-863]. The system authenticates SSH users correctly but does not consistently verify role-based access permissions before executing commands or returning resource data. Authorization decisions appear to rely on incomplete role checks, allowing low-privilege accounts to invoke privileged operations.

Attack Vector

An attacker requires valid credentials and SSH connectivity to the IBM Storage Virtualize management interface. Once authenticated as a low-privileged user, the attacker issues commands or accesses resources that should be restricted to higher-tier administrators. Because the authorization check is missing or incorrect, the system processes these requests, granting effective privilege escalation. No user interaction is required, and the attack complexity is low.

No public proof-of-concept exploit is currently available. Refer to the IBM Support advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-36120

Indicators of Compromise

• Unexpected SSH sessions from non-administrative accounts executing privileged CLI commands such as configuration changes or user management operations.
• Audit log entries showing low-privileged users accessing resources or running commands typically reserved for SecurityAdmin or Administrator roles.
• New or modified user accounts, SSH keys, or role assignments that cannot be traced to authorized change requests.

Detection Strategies

• Enable verbose auditing on the Storage Virtualize CLI and review logs for command execution by accounts outside expected role boundaries.
• Correlate SSH authentication events with subsequent privileged command activity to identify anomalous escalation patterns.
• Compare role-based access policy definitions against actual command usage to surface authorization drift.

Monitoring Recommendations

• Forward IBM Storage Virtualize audit and SSH logs to a centralized SIEM for long-term retention and correlation.
• Alert on any successful privileged command execution by users whose assigned role lacks that capability.
• Track configuration changes, replication policy modifications, and account creation events on the storage cluster in near real time.

How to Mitigate CVE-2025-36120

Immediate Actions Required

• Apply the security update referenced in the IBM Support advisory for CVE-2025-36120 to all affected Storage Virtualize clusters.
• Restrict SSH access to the management interface to a limited set of trusted administrative networks or jump hosts.
• Review all local and remote user accounts on Storage Virtualize systems and remove accounts that are unused or unnecessary.
• Rotate credentials and SSH keys for any account that may have been used during the exposure window.

Patch Information

IBM has published fix information in the official advisory at IBM Support – Node 7240796. Administrators should consult the advisory for the specific fixed builds corresponding to each affected branch (8.4, 8.5, 8.6, and 8.7) and follow the documented upgrade procedure for clustered environments.

Workarounds

• Limit SSH connectivity to the Storage Virtualize management IP using network-layer access control lists until patches can be applied.
• Enforce least-privilege role assignments and remove non-essential user accounts from the storage cluster.
• Require multi-factor authentication on jump hosts and bastion systems used to reach the storage management plane.
• Increase audit log review cadence and alert on any unexpected privileged CLI activity.

# Example: restrict SSH access to the Storage Virtualize management interface
# (apply on the upstream firewall or jump host - adjust IPs to your environment)
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 22 -d <storage_mgmt_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -d <storage_mgmt_ip> -j DROP