CVE-2025-36252: TS4500 Tape Library Insufficient Session Expiration
Published Oct 14, 2026
·Updated
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.
Affected Software
2 affected components
IBM TS4500 Tape Library>=1.1.1.6<=1.12.0.3
IBM Storage TS4500 Library<=1.1.1.6 - 1.12.0.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM TS4500 Tape Library/Diamondback Tape Library firmwareto a version that resolves this vulnerability.Fixed in 1.12.0.4
Event History
Oct 14, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 19, 2026
CVE Published
via MITRE·10:50 PM
Data Sourced
via MITRE·10:50 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker needs authenticated access with low privileges and network access to the affected tape library. No user interaction is required.
2
Which releases are affected?
IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 are affected. The advisory also identifies IBM TS4500 Tape Library/Diamondback Tape Library as affected products.