What is CVE-2025-36254?

CVE-2025-36254 is a high-severity vulnerability in IBM Ds8900f (R9.4), classified under Improper Encoding or Escaping of Output. CVSS score: 7.4/10. Published 2026-08-19.

How severe is CVE-2025-36254?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in IBM Ds8900f (R9.4)

CVE-2025-36254

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H.

Affected products

Ibm Ds8900f (R9.4)
Ibm Ds8a00 (R10.0 - R10.1)

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2025-36254?: CVE-2025-36254 is a high-severity vulnerability in IBM Ds8900f (R9.4), classified under Improper Encoding or Escaping of Output. CVSS score: 7.4/10. Published 2026-08-19.
How severe is CVE-2025-36254?: High severity. CVSS v3 base score is 7.4 out of 10.