Cyber Posture

CVE-2025-13855

High

Published: 01 April 2026

Published
01 April 2026
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0012 30.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of all information inputs, directly preventing SQL injection exploits like CVE-2025-13855 by rejecting specially crafted malicious SQL statements.

SI-2 Flaw Remediation good match
prevent

SI-2 ensures timely identification, reporting, and correction of system flaws, directly mitigating CVE-2025-13855 through patching as per IBM's security advisory.

SI-9 Information Input Restrictions good match
prevent

SI-9 restricts inputs to only organization-defined valid types and quantities, blocking the malicious SQL payloads required to exploit CVE-2025-13855.

Security SummaryAI

CVE-2025-13855 is a SQL injection vulnerability (CWE-89) affecting IBM Storage Protect Server version 8.2.0 and IBM Storage Protect Plus Server. It allows a remote attacker to send specially crafted SQL statements to the affected servers, potentially enabling unauthorized access to the back-end database. The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with low integrity and availability impacts.

A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation could allow the attacker to view sensitive data (C:H), add or modify limited information (I:L), or delete limited data (A:L) in the back-end database, without changing the scope (S:U).

IBM has published a security advisory at https://www.ibm.com/support/pages/node/7267783, which provides details on mitigation and patching instructions for the affected IBM Storage Protect Server 8.2.0 and IBM Storage Protect Plus Server components.

Details

CWE(s)
CWE-89

Affected Products

ibm
storage protect server
8.2.0

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability enables exploitation of remote service (T1210) and unauthorized access to database for data collection (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References