Quick answers
- Is CVE-2025-36061 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-36061 being exploited in the wild.
- How severe is CVE-2025-36061?
- Medium severity, with a CVSS score of 6.5, published 19 October 2026.
- Which products and versions are affected?
- IBM Diamondback Tape Library 1.1.1.6 through 1.12.0.3; IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3.
- Is there a fix for CVE-2025-36061?
- Yes: fixed in Storage TS4500 Library 1.12.0.4 Fix Pack or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-36061 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-36061?
- Check whether you run IBM Diamondback Tape Library or IBM Storage TS4500 Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Storage TS4500 Library 1.12.0.4 Fix Pack or later
Technical details
The Web UI fails to throttle or limit duplicate email notification generation (CWE-770), allowing an authenticated user with administrative privileges to craft multiple user creation requests that generate excessive SMTP traffic. An attacker with admin access can invoke this remotely without user interaction to exhaust system resources. The fix prevents duplicate notification emails from being generated.
Affected products
- IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3
- IBM Diamondback Tape Library 1.1.1.6 through 1.12.0.3
Timeline
- 2026-10-14: disclosed