CVE-2025-13855: SQL Injection in IBM Storage Protect Server

Successful exploitation of CVE-2025-13855 could grant an attacker significant control over the IBM Storage Protect Server's data. An attacker could potentially extract sensitive information such as user credentials, backup configurations, and stored data. Furthermore, they could modify or delete data, disrupting backup and recovery operations. The blast radius extends to any systems relying on the Storage Protect Server for data protection, as compromised backups could be exploited to compromise those systems. This vulnerability shares similarities with other SQL injection attacks, where improperly sanitized user input is leveraged to bypass security controls.

1. Reserved2025-12-01
2. Published2026-04-01
3. EPSS updated2026-04-08

The primary mitigation for CVE-2025-13855 is to upgrade IBM Storage Protect Server to a version containing the security fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting network access to the Storage Protect Server to trusted sources only. Web application firewalls (WAFs) configured with rules to detect and block SQL injection attempts can provide an additional layer of defense. Monitor database logs for suspicious SQL queries that might indicate an ongoing attack. After upgrading, verify the fix by attempting a SQL injection attack against the server using a safe, controlled test query to ensure the vulnerability is no longer present.