Two critical security flaws in IBM Storage Virtualize products could enable attackers to bypass authentication protections and execute malicious code on enterprise storage systems, according to a security bulletin issued by the company.
Tracked as CVE-2025-0159 and CVE-2025-0160, these vulnerabilities impact the graphical user interface (GUI) components of IBM’s SAN Volume Controller, Storwize, Spectrum Virtualize, and FlashSystem product lines.
The more severe vulnerability (CVSS 8.1) allows unauthenticated remote attackers to execute arbitrary Java code through the RPCAdapter service.
This service, designed for system management communications, improperly validates user-supplied input, enabling attackers to bypass security controls and deploy malicious payloads.
Successful exploitation could grant full control over storage infrastructure, potentially compromising sensitive data or disrupting operations across SAN environments.
Rated CVSS 9.1, this flaw permits attackers to circumvent authentication mechanisms via specially crafted HTTP requests to the RPCAdapter endpoint.
The vulnerability stems from improper validation of session tokens, allowing unauthorized access to administrative functions without valid credentials.
Combined with CVE-2025-0160, attackers could chain these exploits to first bypass authentication checks and then escalate privileges through code execution.
Affected Products and Versions
The vulnerabilities impact multiple IBM storage platforms running vulnerable GUI components:
Specific vulnerable software versions include:
IBM released fixed versions for all affected products:
The company strongly recommends applying updates immediately, as both vulnerabilities require no user interaction for exploitation. Administrators should:
While IBM confirms no active exploits in the wild, the critical nature of these flaws makes prompt patching essential.
Organizations should monitor authentication logs for suspicious RPCAdapter activity and restrict GUI access to trusted networks where possible.
These vulnerabilities highlight the growing risks in storage infrastructure security, particularly as enterprises accelerate cloud migrations and hybrid deployments.
Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.
Trend Micro, a cybersecurity firm, has released its 50th installment report on the Russian-speaking cybercriminal…
The Pakistan-linked Advanced Persistent Threat (APT) group known as SideCopy has significantly expanded its targeting…
Russian state-backed advanced persistent threat (APT) group Storm-2372 has exploited device code phishing to bypass…
Threat actors are exploiting weaknesses in SMS verification systems to generate massive, fraudulent message traffic,…
The cyber threat landscape has witnessed remarkable adaptation from the notorious hacker collective known as…
North Korean threat actors have demonstrated their adept use of social engineering techniques combined with…