CVE-2023-47700 is an improper certificate validation flaw in the GUI of IBM Storage Virtualize 8.6, covering IBM SAN Volume Controller, Storwize and FlashSystem products. NVD scores it 5.9, Medium. IBM says to upgrade to code level 8.6.0.3 or 8.6.2.0 or higher.
What's affected
IBM's bulletin says the certificate for a remote system in a policy-based replication partnership is not correctly validated in the GUI on IBM Storage Virtualize products. The affected version is 8.6, per both the record and the bulletin.
IBM lists these products as needing the upgrade: IBM SAN Volume Controller, Storwize V7000, V5000 and V5100, V5000E, Storage Virtualize Software, Storage Virtualize for Public Cloud, FlashSystem V9000, 9500, 9100 family, 9200, 7300, 7200, 5200 and 5000. The fixed code levels are 8.6.0.3 and 8.6.2.0, or higher.
The weakness is CWE-295, improper certificate validation. The NVD vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, and IBM's bulletin gives the same 5.9 score in CVSS 3.0 form. No conflict on severity or versions. IBM lists no workarounds.
How to check if you're exposed
Read the code level in the management GUI, or from the command line on the system with the version query your IBM documentation gives. Systems on 8.6 below 8.6.0.3 on the 8.6.0 stream, or below 8.6.2.0 on the 8.6.2 stream, need the upgrade.
Then ask whether you use policy-based replication between systems. The flaw concerns the certificate of a remote system in a replication partnership, so systems without that feature configured are less exposed in practice. IBM's bulletin does not say that the flaw is limited to those systems, so do not skip the upgrade on that basis alone.
What to do now
- Upgrade to code level 8.6.0.3 or 8.6.2.0, or higher, using IBM's code download pages for your product.
- Plan the upgrade with your usual storage change process, since these are production storage systems.
- List which systems have policy-based replication partnerships, and check them first.
- Record the partner systems and their certificates, so you can verify them manually if an alert appears.
- Subscribe to IBM's security bulletin notifications for your product line.
Why it matters
Certificate validation is how one system knows that the other end is the system it claims to be. If the check is skipped or incomplete, an attacker who can sit in the network path can present their own certificate and be accepted. IBM's description says a user could end up connecting to a malicious host, believing it was a trusted system, and be deceived into accepting spoofed data.
The weakness class is CWE-295. The score is Medium because the attack complexity is High: the attacker has to be in a position to intercept the connection. The only impact the vector rates is integrity, High. That is because the danger is spoofed data, not stolen data.
Storage replication moves a large amount of important data between sites. An integrity problem in that path is worth a planned upgrade, even if the score looks modest.
Quick check
Is there a workaround?
IBM lists none. The fix is the upgrade.
Does this affect storage on versions before 8.6?
The record and bulletin name 8.6 only.
Sources
- IBM security bulletin for CVE-2023-47700
- IBM X-Force entry 271016
- Safeguard Gold page for CVE-2023-47700
Last reviewed: 19 October 2026.
