What’s Vulnerable › Vulnerabilities

CVE-2023-43040: IBM Spectrum Fusion HCI improper access control

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-1220

Description

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

Affected products

• IBM Storage Fusion HCI: from 2.5.2 before 2.8.0 — fixed in 2.8.0

How to fix

Upgrade to a fixed version: IBM Storage Fusion HCI 2.8.0. Check the vendor advisory for mitigations.

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/266807
• https://www.ibm.com/support/pages/node/7151040
• https://exchange.xforce.ibmcloud.com/vulnerabilities/266807
• https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
• https://lists.debian.org/debian-lts-announce/2025/09/msg00025.html
• https://www.ibm.com/support/pages/node/7151040

Get alerted when CVE-2023-43040 or the next vulnerability affects your stack