CVE-2023-35897: IBM Spectrum Protect code execution

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-06 · updated 2026-06-17
Weakness: CWE-94

Description

IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-Force ID: 259246.

Affected products

IBM Storage Protect Client: from 8.1.0.0 through 8.1.19.0
IBM Storage Protect Client: from 8.1.0.0 through 8.1.19.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/259246
https://www.ibm.com/support/pages/node/7037299
https://exchange.xforce.ibmcloud.com/vulnerabilities/259246
https://www.ibm.com/support/pages/node/7037299

Get alerted when CVE-2023-35897 or the next vulnerability affects your stack