External risk intelligence

IBM Storage Fusion Insecure Defaults Expose AMQStreams to Unauthorized Actions.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-36222

IBM Fusion and its associated HCI products are typically deployed as back-end data storage and infrastructure management platforms within private enterprise data centers or private cloud environments. While they operate over a network, they are generally not intended to be exposed directly to the public internet, making public-facing deployment of the affected AMQStreams component uncommon.

Ibm Storage Fusion

2.2.0 to before 2.11.02.8.2 to before 2.11.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM Fusion products, specifically related to insecure default configurations that could allow unauthorized access and actions by exposing AMQStreams without client authentication. This issue could potentially impact the confidentiality, integrity, and availability of systems using these IBM products. The main concern is confirming relevance and exposure within your environment.

Insecure defaults allow unauthenticated access.
Key IBM infrastructure products are affected.
Confirm if your IBM Fusion is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could target IBM Fusion products by leveraging insecure default configurations that expose AMQStreams. If these streams are accessible over the network without authentication, an attacker could potentially perform unauthorized actions within the system.

Network exposure without authentication.
Exploits insecure default configurations.
Allows unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

Insecure default configurations in IBM Fusion products could allow an unauthenticated attacker to access AMQStreams without authentication, potentially leading to unauthorized actions. This could affect the integrity and availability of the affected systems when the AMQStreams component is exposed externally.

Unauthorized access to AMQStreams.
Exploitation via network, no authentication needed.
Data integrity and availability risks.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and platform teams are likely responsible for IBM Fusion products, given their role in managing storage and HCI environments. The initial step is to locate all instances of the affected technology, verify its network exposure and business criticality, and identify the accountable owner to plan remediation based on risk.

Identify all Fusion instances and owners.
Confirm AMQStreams reachability and criticality.
Plan remediation with asset owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Storage Fusion?

IBM Storage Fusion is a software-defined storage and data platform designed for Red Hat OpenShift. It provides container-native storage services, data management, and backup capabilities across hybrid cloud environments. IBM Storage Fusion HCI and the watsonx-specific variants are integrated infrastructure solutions that bundle these storage services with compute resources to simplify data workloads for AI and enterprise applications.

What does CVE-2025-36222 mean?

This CVE identifies a security weakness classified as CWE-1188, which involves the use of insecure default configurations. In this specific case, the software fails to require client authentication for AMQStreams. Because authentication is missing by default, a network-based attacker can interact with these message streams without proving their identity, leading to potential unauthorized actions within the system.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker accesses the AMQStreams component over the network. Crucially, the bug arises because of the default configuration that skips authentication; it is not triggered by specific user actions or complex inputs. If the system is configured to require strict authentication for these streams, the underlying vulnerability remains, but the attack path is significantly blocked.

Do I need to worry about this if my systems are internal?

Halo Surface Signal indicates that IBM Fusion and its HCI variants are typically used as back-end infrastructure within private data centers or clouds. While the vulnerability is network-based, the risk is lower for systems isolated from the public internet. You should care if your architecture inadvertently exposes these storage management components to wider networks or untrusted segments.

What is the first step to address this issue?

Start by identifying all deployed instances of IBM Storage Fusion, Storage Fusion HCI, or the watsonx variants within your environment. Once you have a complete inventory, verify the network reachability of the AMQStreams component for each instance. Collaborate with your platform or infrastructure team to assess the criticality of these assets and prioritize them for vendor-provided updates.

References

www.ibm.com/support/pages/node/7244646

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.