CVE-2025-36255 in DS8A00
Summary
by MITRE • 08/20/2026
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in IBM System Storage DS8A00 and IBM DS8900F firmware versions represents a critical flaw in the access control mechanisms governing administrative account creation. Specifically, within the affected software ranges of DS8A00 from 10.1.3.0 through 10.11.35.0 and DS8900F from 89.40.83.0 through 89.44.25.0, an authenticated user is able to exploit improper privilege definitions associated with unsafe actions. This flaw allows the creation of new user accounts that are automatically assigned privileged roles without requiring appropriate authorization or validation checks by higher-level administrators. The core technical issue lies in the system's failure to enforce strict separation of duties and role-based access control during the provisioning process, effectively bypassing intended security boundaries through a logic error rather than a traditional buffer overflow or injection attack.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Assignment. The root cause stems from insufficient validation of user roles when new accounts are instantiated via the management interface. When an authenticated individual triggers the account creation workflow, the system fails to verify whether the requesting entity possesses the necessary administrative privileges to assign elevated rights such as Super User or Security Administrator levels. Consequently, a lower-privileged user can escalate their own access level by creating a secondary account with full administrative capabilities. This behavior violates fundamental principles of least privilege and secure default configurations, allowing lateral movement within the storage management infrastructure once initial authentication is achieved.
The operational impact of this vulnerability is severe for organizations relying on these IBM storage arrays for critical data operations. An attacker who gains authenticated access to the system can create a backdoor account with unrestricted privileges, leading to complete compromise of the storage environment. This enables unauthorized modification or deletion of stored data, potential exfiltration of sensitive information, and disruption of business continuity services dependent on the storage infrastructure. Furthermore, because the vulnerability allows for persistent privileged access, it facilitates long-term stealthy presence within the network, making detection difficult without rigorous auditing of user creation events. The ability to escalate privileges from a standard authenticated session effectively neutralizes existing perimeter defenses that rely on strong authentication as the primary control mechanism.
In terms of industry frameworks, this flaw aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically involving local accounts and privilege escalation. It also relates to T1136, Create Account, where adversaries create new accounts to maintain access or escalate privileges. The vulnerability underscores the importance of implementing robust input validation and authorization checks for all administrative functions within enterprise storage systems. Security architects must recognize that authentication alone is insufficient if role assignment logic contains flaws that allow privilege escalation through legitimate system features.
To mitigate this risk, organizations running affected firmware versions should immediately apply the latest security patches provided by IBM to close the gap in privileged account creation validation. Until patching is complete, administrators should enforce strict network segmentation to limit access to the storage management interfaces only from trusted administrative workstations. Additionally, implementing multi-factor authentication for all user accounts adds a layer of defense against credential theft that could lead to exploitation of this flaw. Regular auditing of user creation logs and monitoring for unusual privilege assignments can help detect potential abuse attempts early. It is also recommended to review existing role-based access control policies to ensure they align with the principle of least privilege, minimizing the impact if such vulnerabilities are exploited in other systems within the environment.