CVE-2025-13855
Published: 01 April 2026
Summary
CVE-2025-13855 is a high-severity SQL Injection (CWE-89) vulnerability in Ibm Storage Protect Server. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of all information inputs, directly preventing SQL injection exploits like CVE-2025-13855 by rejecting specially crafted malicious SQL statements.
SI-2 ensures timely identification, reporting, and correction of system flaws, directly mitigating CVE-2025-13855 through patching as per IBM's security advisory.
SI-9 restricts inputs to only organization-defined valid types and quantities, blocking the malicious SQL payloads required to exploit CVE-2025-13855.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability enables exploitation of remote service (T1210) and unauthorized access to database for data collection (T1213.006).
NVD Description
IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Deeper analysisAI
CVE-2025-13855 is a SQL injection vulnerability (CWE-89) affecting IBM Storage Protect Server version 8.2.0 and IBM Storage Protect Plus Server. It allows a remote attacker to send specially crafted SQL statements to the affected servers, potentially enabling unauthorized access to the back-end database. The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with low integrity and availability impacts.
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation could allow the attacker to view sensitive data (C:H), add or modify limited information (I:L), or delete limited data (A:L) in the back-end database, without changing the scope (S:U).
IBM has published a security advisory at https://www.ibm.com/support/pages/node/7267783, which provides details on mitigation and patching instructions for the affected IBM Storage Protect Server 8.2.0 and IBM Storage Protect Plus Server components.
Details
- CWE(s)