Critical severity · published Jun 20, 2025
CVE-2025-3319
IBM Spectrum Protect Server authentication bypass
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spectrum Protect Server · IBM
8.1 through 8.1.26 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3319
Vendor Advisory
https://www.ibm.com/support/pages/node/7236999
More from Spectrum Protect Server
7.5
CVE-2024-38320
IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure