CVE-2025-0160 is a high severity (CVSS 8.1) flaw in the RPCAdapter service of IBM Storage Virtualize, used in IBM FlashSystem and related products. A remote attacker with access to the system could execute arbitrary Java code. IBM lists fixed levels of 8.5.0.14, 8.6.0.6, 8.7.0.3 and 8.7.2.2, so upgrade to the one for your line.
What's affected
IBM security bulletin for the Storage Virtualize GUI covers IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products. The affected software levels in the record are 8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, and 8.7.2.0 through 8.7.2.1.
The record says a remote attacker with access to the system could execute arbitrary Java code because of improper restrictions in the RPCAdapter service. The weakness is mapped to process control, and the vector has high attack complexity.
IBM's bulletin says the vulnerabilities are in the GUI and that the CLI is unaffected. It lists fixed levels in a table: 8.5.0.14, 8.6.0.6, 8.7.0.3 and 8.7.2.2, depending on your current level. Read the table in the bulletin to pick the right target for your system. The bulletin was first published on 28 February 2025 and lists no workarounds or mitigations.
How to check if you're exposed
Find the software level of each system.
- In the management GUI, open the system or about page and read the code level.
- From the CLI, the following command shows the code level.
lssystem
Look for the code level field in the output, and compare it with the affected list above.
- Open the IBM bulletin and find your level in the fix table.
- Check who can reach the management interface. The bulletin says the GUI is affected, so restricting access to a management network lowers the risk until you can upgrade.
What to do now
- Inventory every SAN Volume Controller, Storwize, Spectrum Virtualize and FlashSystem system and its code level.
- Look up the fixed level for each in the IBM bulletin table: 8.5.0.14, 8.6.0.6, 8.7.0.3 or 8.7.2.2.
- Plan the upgrade with your storage team, following IBM's upgrade instructions and your change process.
- Restrict access to the management GUI to a dedicated management network.
- Review GUI and system logs for unexpected activity.
- Record the new levels in your inventory.
Why it matters
Code execution on a storage controller is a serious outcome, since the controller manages volumes, replication and the credentials that other systems use to reach the array. The high complexity in the vector tempers the score, as it means the attacker needs conditions that are not fully in their control.
The class is process control: the service lets outside input steer which code the process loads or runs. The related record CVE-2025-0159 describes an authentication bypass in the same service, and IBM publishes both in one bulletin. Patch both together, and keep the GUI on a management network that ordinary users cannot reach.
The weakness class is CWE-114: Process Control. The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 8.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Why is the score high and not critical?
The vector uses high attack complexity, which lowers the score compared with the related authentication bypass.
Which fixed levels does IBM list?
8.5.0.14, 8.6.0.6, 8.7.0.3 and 8.7.2.2, depending on your current level.
Sources
Last reviewed: 19 October 2026.
