CVE-2025-36255 is a High severity (CVSS 7.5) flaw in IBM System Storage DS8A00 and DS8900F, where an authenticated user can create a user with privileged roles. IBM says only the Hardware Management Console is affected. Fixes ship in newer microcode bundles listed below.
What's affected
Per the IBM bulletin, the affected releases are:
- IBM DS8A00 10.1.3.0 through 10.11.35.0 (releases R10.0 to R10.1)
- IBM DS8900F 89.40.83.0 through 89.44.25.0 (release R9.4)
IBM notes that the listed CVEs only affect the HMC, and that the HMC holds no customer data files. It also notes that all microcode for DS8900F R9.0 to R9.3 is affected.
Fixed bundles named by IBM: for DS8A00, 10.11.34.1 and 10.12.39.0. For DS8900F, 89.44.17.1, 89.44.25.1, 89.44.26.0 and 89.45.10.0. Customers on 10.11.34.0, 89.44.17.0 or 89.44.25.0 can take the matching HMC only update, which does not need a full code update.
How to check if you're exposed
Find the installed microcode bundle on your DS8A00 or DS8900F from the management console and compare it with the ranges above. IBM's code recommendation page, linked from the bulletin, explains how to choose a bundle. IBM also notes a potential loss of data on an unexpected power outage as a factor in bundle selection, so read that note before scheduling.
Because the flaw needs an authenticated user, also list who holds accounts on the HMC today and review any accounts created recently.
What to do now
- Identify every DS8A00 and DS8900F system and its microcode bundle.
- Choose the fixed bundle from the IBM list that matches your release, and plan the update. Where an HMC only update is offered, use it to shorten the change window.
- Review HMC user accounts and roles for anything you do not recognise.
- Use the access controls IBM names as mitigations: LDAP, multi-factor authentication and audit logging, and restrict who can reach the console.
- Record the change against the IBM bulletin for audit purposes.
Why it matters
The weakness is CWE-267 (Privilege Defined With Unsafe Actions). A privileged action was defined in a way that lets a lower privileged, authenticated user create an account with elevated roles. This is a privilege escalation, not a way in from nowhere.
The CVSS vector is network, high complexity, low privileges, no user interaction and high impact across confidentiality, integrity and availability. High complexity pulls the score down to 7.5.
IBM stresses that DS8000 systems sit in client data centers where clients control access, and that the HMC holds no customer data files. That lowers real world urgency for well segmented sites, but an extra admin account on a storage controller is still a serious foothold. The record does not mark the CVE as exploited.
Quick check
Does this give an outsider access?
No. The flaw needs an authenticated user. It lets that user gain privileged roles.
Do I need a full code update?
Not always. IBM offers HMC only updates for customers on 10.11.34.0, 89.44.17.0 and 89.44.25.0. Other cases need the full bundle.
Sources
Last reviewed: 18 October 2026.
