IT49201: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2025-53066,CVE-2025-53057

APAR status

• Closed as program error.

Error description

• All applicable Java SE CVEs published by Oracle as part of their
  October 2025 Critical Patch Update. See attached documents for
  full details.
  
  Please keep an eye on the October 2025 CPU PSIRT slack thread
  for updates:
  
  https://ibm-cloud.slack.com/archives/G01HDDG15L3/p17613026076192
  89
  
  
  CVEID:   CVE-2025-53066
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the JAXP component could allow a remote attacker to cause
  high confidentiality impact, no integrity impact, and no
  availability impact.
  CWE:   CWE-200: Exposure of Sensitive Information to an
  Unauthorized Actor
  CVSS Source:   secalert_us@oracle.com
  CVSS Base score:   7.5
  CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
  
  CVEID:   CVE-2025-53057
  DESCRIPTION:   An unspecified vulnerability in Java SE related
  to the Security component could allow a remote attacker to cause
  no confidentiality impact, high integrity impact, and no
  availability impact.
  CWE:   CWE-284: Improper Access Control
  CVSS Source:   secalert_us@oracle.com
  CVSS Base score:   5.9
  CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2025-53066,CVE-2025-53057                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• SECURITY APAR FOR:
  CVE-2025-53066,CVE-2025-53057
  
  The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 2Q26   [ 54X-IBM-SI ]
  ( release target 2Q 2026 / June )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels