CVE-2025-36398: IBM DS8000 Storage Information Disclosure

CVE-2025-36398 Overview

CVE-2025-36398 affects IBM System Storage DS8A00 and IBM DS8900F enterprise storage systems. The vulnerability allows an authenticated user to read or modify another user's command history. The root cause is an externally controlled filename [CWE-73] in the affected components. Attack requires low privileges and no user interaction over the network.

Affected versions include IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0. The vulnerability enables horizontal privilege actions against peer user data stored on the appliance.

Critical Impact
Authenticated users can read or modify another user's command history on affected IBM DS8A00 and DS8900F storage arrays, exposing operational commands and enabling tampering.

Affected Products

IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0
IBM DS8900F versions 89.40.83.0 through 89.44.25.0
Management interfaces on the DS8000 family that expose per-user command history files

Discovery Timeline

2026-08-19 - CVE-2025-36398 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2025-36398

Vulnerability Analysis

The vulnerability is classified under [CWE-73] External Control of File Name or Path. The affected DS8A00 and DS8900F systems accept user-supplied input that determines the filename used when reading or writing command history data. Because the software does not sufficiently constrain the resolved path to the calling user's directory, an authenticated actor can substitute another user's history file path.

Command history on storage controllers frequently contains sensitive operational context. This includes device configuration commands, provisioning actions, credential-related operations, and troubleshooting steps. Exposing that data to a peer user leaks internal storage operations. Modification enables tampering with audit trails or planting misleading entries that another user may re-execute.

Exploitation does not require elevated privileges. An account holder on the storage system can operate within their normal session context. See the IBM Support Document for vendor technical details.

Root Cause

The application uses user-controlled input to compose the filename or path referencing command history files. Access decisions rely on the constructed path rather than on an authorization check tied to the authenticated identity. This allows one user's session to target another user's history file.

Attack Vector

An authenticated attacker interacts with the management surface of the DS8A00 or DS8900F. The attacker supplies a filename or identifier that resolves to another user's command history file. The system reads or writes the targeted file without verifying ownership. No user interaction from the victim is required, and the vector is network reachable.

No public proof-of-concept code is available for CVE-2025-36398 at the time of publication. Refer to the vendor advisory linked above for parameter-level technical details.

Detection Methods for CVE-2025-36398

Indicators of Compromise

Access log entries showing a user session reading or writing history files that do not belong to that user's home path.
Unexpected modifications, timestamps, or truncation on per-user command history files on DS8A00 or DS8900F controllers.
Command history entries appearing under accounts that were not active during the recorded time window.

Detection Strategies

Baseline the expected file access patterns of each administrator account and alert on cross-user history file reads or writes.
Correlate authenticated session identifiers with the file paths accessed to detect divergence between the calling user and the resource owner.
Review management interface audit logs for filename parameters containing traversal characters or other user identifiers.

Monitoring Recommendations

Forward DS8000 management audit logs to a centralized SIEM and retain them for a period consistent with change-management review cycles.
Alert on privileged storage account activity outside standard maintenance windows.
Monitor for anomalous read volumes on user home directories on the storage controller.

How to Mitigate CVE-2025-36398

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Document to affected DS8A00 and DS8900F systems.
Inventory DS8A00 systems running 10.1.3.0 through 10.11.35.0 and DS8900F systems running 89.40.83.0 through 89.44.25.0 and schedule remediation.
Rotate credentials for administrative accounts on affected controllers if cross-user access to command history is suspected.

Patch Information

IBM has published guidance under the referenced support document. Administrators should upgrade to the fixed firmware release identified by IBM for both product lines. Verify version strings after upgrade to confirm remediation.

Workarounds

Restrict management network access to the DS8000 family to a small set of jump hosts and administrator workstations.
Reduce the number of accounts with access to the storage management interface until the patch is applied.
Increase audit review cadence on the management interface while unpatched.

bash

# Verify the running firmware version on the DS8000 management CLI
# Replace <host> with the storage controller HMC address
ssh admin@<host> "ver -l"

# Confirm the reported code level is at or above the IBM-provided fixed release
# before returning the system to normal operational access controls