CVE-2025-0159CRITICAL 9.1EPSS p51.6%
CVE-2025-0159CVE-2025-0159
Description
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.
Scoring
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 0.80% probability of exploitation · percentile 51.6% · 2026-06-19T12:03:05Z |
| Published | 2025-02-28 |
| Last modified | 2025-08-18 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Authentication Bypass Using an Alternate Path or Channelcwe-288 | 0% | live |
| Weakness | Missing Authentication for Critical Functioncwe-306 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.