CVE-2023-46172 is a medium severity (CVSS 5.6) authentication bypass in the IBM DS8900F Hardware Management Console. The record lists several 89.x microcode levels as affected. IBM names microcode bundle 89.40.89.0 as the fix, and says there are no workarounds. Schedule a remote code load or contact IBM Support.
What's affected
The record lists DS8900F HMC levels 89.22.19.0, 89.30.68.0, 89.32.40.0 and the description also names 89.21.19.0, 89.21.31.0 and 89.33.48.0. The IBM bulletin says all microcode up to and including R9.2 89.22.19.0 and R9.3 89.30.68.0, 89.32.40.0 and 89.33.48.0 is affected. The two sources do not list exactly the same levels, so rely on the IBM bulletin.
IBM names Microcode Bundle 89.40.89.0 (R9.4 GA2) as the fix for all CVEs in the bulletin. Its bulletin says no workarounds or mitigations exist. It also says CVE-2023-46172 affects only HMC log files that do not contain customer data.
The NVD record scores it 5.6 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The weakness class is CWE-287 (improper authentication). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the installed microcode level on the HMC or in the DS CLI against the list above. IBM Support can confirm the bundle level on your system. If you run DS8900F storage, your storage administrator or IBM account team can also tell you the scheduled code level.
There is no package manager step here. The advisory steps are to schedule a Remote Code Load or ask IBM Support to apply the fix bundle.
What to do now
- Find the current microcode bundle on each DS8900F HMC.
- Schedule a Remote Code Load for bundle 89.40.89.0, or contact IBM Support to request it.
- Restrict HMC management network access to administrators in the meantime, as IBM lists no workaround.
- Review HMC logs and access records for unexpected logins.
- Document the new bundle level in your asset records.
Why it matters
The weakness is improper authentication (CWE-287). The vector rates attack complexity as high, which is why the score is medium, but the access is remote and needs no privileges.
Storage management consoles sit close to data and backups. Even a flaw that IBM scopes to log files is worth fixing through the normal code load schedule, because that is the only remediation available.
Quick check
Is there a workaround?
IBM says none, so use the code load.
Does it expose customer data?
IBM says the issue affects only HMC log files that do not contain customer data.
Sources
Last reviewed: 19 October 2026.
