What is CVE-2025-36192?

CVE-2025-36192 is a medium-severity vulnerability in IBM Ds8900f ( R9.4), classified under Missing Authorization. CVSS score: 6.7/10. Published 2025-12-26.

How severe is CVE-2025-36192?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Auth bypass in IBM Ds8900f ( R9.4)

CVE-2025-36192

IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

Vulnerability class: Broken Access Control

EPSS: 0.001 (1.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Ibm Ds8900f ( R9.4) — versions 89.40.83.0, 89.42.18.0, 89.44.5.0
Ibm Ds8a00 — versions 10.1, 10.0, 9.4
Ibm Ds8a00_firmware — versions 10.10.106.0, 10.1.3.0, 10.2.45.0
Ibm Ds8a00 ( R10.0) — versions 10.1.3.0, 10.2.45.0
Ibm Ds8a00( R10.1) — versions 10.10.106.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

psirt@us.ibm.com (vendor-advisory, patch, Vendor Advisory)

Frequently asked questions

What is CVE-2025-36192?: CVE-2025-36192 is a medium-severity vulnerability in IBM Ds8900f ( R9.4), classified under Missing Authorization. CVSS score: 6.7/10. Published 2025-12-26.
How severe is CVE-2025-36192?: Medium severity. CVSS v3 base score is 6.7 out of 10.