What’s Vulnerable › Vulnerabilities

CVE-2023-25681: IBM Spectrum Virtualize security bypass

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-05 · updated 2026-06-17
• Weakness: CWE-308

Description

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID: 247033.

Affected products

• IBM Spectrum Virtualize: 8.5.0.0

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/247033
• https://www.ibm.com/support/pages/node/6962203
• https://exchange.xforce.ibmcloud.com/vulnerabilities/247033
• https://www.ibm.com/support/pages/node/6962203

Get alerted when CVE-2023-25681 or the next vulnerability affects your stack