CVE-2025-36255 Overview
CVE-2025-36255 affects IBM System Storage DS8A00 and IBM DS8900F storage systems. The vulnerability allows an authenticated user to create new users with privileged roles due to improperly defined privileges tied to unsafe actions. The flaw is categorized under [CWE-267], Privilege Defined With Unsafe Actions. Successful exploitation results in vertical privilege escalation within the storage management plane. IBM published an advisory tracked at IBM Support Page Advisory.
Critical Impact
An authenticated low-privileged user can escalate to administrative control over IBM DS8A00 and DS8900F storage systems, enabling unauthorized creation of privileged accounts.
Affected Products
- IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0
- IBM DS8900F versions 89.40.83.0 through 89.44.25.0
- IBM enterprise storage management interfaces exposing user administration
Discovery Timeline
- 2026-08-19 - CVE-2025-36255 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2025-36255
Vulnerability Analysis
The vulnerability resides in the user management functionality of IBM DS8A00 and DS8900F storage controllers. The system defines privileges in a way that allows an authenticated user to invoke actions beyond their assigned role. Specifically, the account creation action does not enforce a strict role boundary between the caller and the roles that can be assigned to newly created users. An attacker with valid credentials can therefore create additional accounts and grant those accounts privileged roles, including administrative access to storage volumes, replication configuration, and audit settings.
Root Cause
The root cause is an improperly scoped privilege definition mapped to an unsafe action, consistent with [CWE-267]. The action responsible for user creation trusts the requester's session but fails to validate that the requester holds the authority to assign the requested target role. This trust boundary error allows role assignment to exceed the caller's own privilege level.
Attack Vector
Exploitation requires network access to the DS8A00 or DS8900F management interface and valid authenticated credentials. The attacker submits a user creation request specifying a privileged role. The system processes the request without a role-elevation check and provisions the new account. The attacker then authenticates as the newly created privileged user and pivots to full storage administration. The vulnerability requires no user interaction and does not depend on client-side conditions.
No public proof-of-concept has been published. See the IBM Support Page Advisory for vendor-supplied technical detail.
Detection Methods for CVE-2025-36255
Indicators of Compromise
- Unexpected user accounts appearing in DS8A00 or DS8900F user directories, particularly accounts holding administrator, security administrator, or storage administrator roles.
- Audit log entries showing user creation actions initiated by accounts that do not normally perform user administration.
- Authentication events from newly created accounts followed by configuration changes to volumes, hosts, or copy services.
Detection Strategies
- Baseline the current authorized user roster on each DS8A00 and DS8900F system and alert on any deviation.
- Correlate user-creation audit events with the assigning account's assigned role to flag privilege inversions where a lower-privileged account creates a higher-privileged one.
- Forward IBM storage audit logs to a central SIEM and apply detection rules on the createuser and role-assignment commands.
Monitoring Recommendations
- Enable and centrally collect DS8000-family audit logs, including all mkuser, chuser, and role modification commands.
- Review privileged account inventories daily until patched systems are confirmed in production.
- Alert on management-plane logins from unusual source IPs or outside change windows.
How to Mitigate CVE-2025-36255
Immediate Actions Required
- Restrict network access to the DS8A00 and DS8900F management interfaces to a defined administrative network segment.
- Audit all existing storage accounts and remove any user not explicitly required for operations.
- Rotate credentials for any account with access to the storage management plane.
- Apply the fixed firmware level identified in the IBM advisory as soon as change windows allow.
Patch Information
IBM has published remediation guidance in the IBM Support Page Advisory. Administrators should upgrade DS8A00 systems beyond version 10.11.35.0 and DS8900F systems beyond version 89.44.25.0 to the fixed level referenced in the advisory.
Workarounds
- Enforce least privilege on all storage management accounts and remove account-creation rights from roles that do not require them.
- Require multi-factor authentication on the identity provider backing storage administrator accounts where supported.
- Isolate the storage management network from general enterprise traffic and require jump-host access for administration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
