CVE-2025-0160 IBM FlashSystem code execution

What is CVE-2025-0160?

CVE-2025-0160 is a high-severity code injection vulnerability in IBM Storage Virtualize, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.

Weakness: CWE-114

Which versions are affected by CVE-2025-0160?

It affects 1 product.

Products include Ibm Storage Virtualize.

How do I fix CVE-2025-0160?

No fix has been published for CVE-2025-0160 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-0160 being exploited?

There is no known exploitation of CVE-2025-0160 in the wild and no public exploit code.

Other vulnerabilities in IBM Storage Virtualize

• CVE-2025-0159 IBM FlashSystem authentication bypass Critical 9.1
• CVE-2025-36120 IBM Storage Virtualize privilege escalation High 8.8
• CVE-2025-36118 IBM Storage Virtualize Information Disclosure High 7.5
• CVE-2023-43042 IBM Storage Virtualize information disclosure High 7.5
• CVE-2025-1351 IBM Storage Virtualize privilege escalation Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-69vm-8rmf-jw2p.