CVE-2025-0159 is a critical (CVSS 9.1) authentication bypass in the RPCAdapter endpoint of IBM Storage Virtualize, used in IBM FlashSystem and related storage products. A remote attacker can bypass authentication with a crafted HTTP request. IBM lists fixed levels of 8.5.0.14, 8.6.0.6, 8.7.0.3 and 8.7.2.2, so upgrade to the one for your line.
What's affected
IBM security bulletin for the Storage Virtualize GUI covers IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products. The affected software levels in the record are 8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, and 8.7.2.0 through 8.7.2.1.
The record says a remote attacker could bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request. The weaknesses are authentication bypass using an alternate path and missing authentication for a critical function.
IBM's bulletin says the vulnerabilities are in the GUI and that the CLI is unaffected. It lists fixed levels in a table: 8.5.0.14, 8.6.0.6, 8.7.0.3 and 8.7.2.2, depending on your current level. Read the table in the bulletin to pick the right target for your system. The bulletin was first published on 28 February 2025 and lists no workarounds or mitigations.
How to check if you're exposed
Find the software level of each system.
- In the management GUI, open the system or about page and read the code level.
- From the CLI, the following command shows the code level.
lssystem
Look for the code level field in the output, and compare it with the affected list above.
- Open the IBM bulletin and find your level in the fix table.
- Check who can reach the management interface. The bulletin says the GUI is affected, so restricting access to a management network lowers the risk until you can upgrade.
What to do now
- Inventory every SAN Volume Controller, Storwize, Spectrum Virtualize and FlashSystem system and its code level.
- Look up the fixed level for each in the IBM bulletin table: 8.5.0.14, 8.6.0.6, 8.7.0.3 or 8.7.2.2.
- Plan the upgrade with your storage team, following IBM's upgrade instructions and your change process.
- Restrict access to the management GUI to a dedicated management network.
- Review GUI and system logs for unexpected activity.
- Record the new levels in your inventory.
Why it matters
Storage systems hold the data that everything else depends on, and their management interfaces are among the most sensitive ones in a data center. An authentication bypass on that interface removes the control that decides who may change the system.
The classes are bypass using an alternate path or channel, and missing authentication for a critical function. Both point to the same lesson: every route to a sensitive function must run the same authentication check, and an internal helper endpoint is a route too. This CVE is paired with CVE-2025-0160 in the same bulletin, which covers Java code execution through the same service, so a bypass here and a code flaw there make a strong combination. Patch both together.
The weakness class is CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-306: Missing Authentication for Critical Function. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which scores 9.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Does the CLI have the same problem?
IBM's bulletin says the CLI is unaffected. The issues are in the GUI.
Is there a workaround?
The bulletin lists none, so upgrade and limit access to the management network.
Sources
Last reviewed: 19 October 2026.
