# CVE-2025-36069: IBM Storage TS4500 Library insufficient session expiration

Source: https://junglewise.ai/threats/cve-2025-36069-ibm-storage-ts4500-library-1-1-1-6-through-1-12-0-3-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2025-36069 · Severity: medium · CVSS 5.5 · Published 2026-10-19

IBM Storage TS4500 Library is a tape storage appliance used for enterprise data backup and archival. The system fails to invalidate user sessions after logout or account changes, allowing attackers with a stolen session token to impersonate other users and access sensitive data. An authenticated attacker could maintain unauthorized access even after password changes or privilege modifications.

Technologies: [IBM Storage TS4500 Library](https://junglewise.ai/threats/technologies/storage-ts4500-library). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36069 being exploited in the wild.

**How severe is CVE-2025-36069?** Medium severity, with a CVSS score of 5.5, published 19 October 2026.

**Which products and versions are affected?** IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3.

**Is there a fix for CVE-2025-36069?** Yes: fixed in Storage TS4500 Library 1.12.0.4 Fix Pack or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-36069 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-36069?** Check whether you run IBM Storage TS4500 Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Storage TS4500 Library 1.12.0.4 Fix Pack or later

## Technical details

The Web UI and REST interfaces do not properly invalidate active user sessions after security-sensitive account changes including password changes, password resets, or role and privilege updates (CWE-613: Insufficient Session Expiration). An authenticated user with a stolen or intercepted session token can reuse it to access the account without re-authentication. The vulnerability requires network access and prior authentication but can lead to account impersonation and privilege reuse.

## Affected products

- IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3

## Timeline

- 2026-10-14: disclosed
- 2026-10-19: advisory

## References

- [https://www.ibm.com/support/pages/node/7292613](https://www.ibm.com/support/pages/node/7292613)

## Related threats

- [IBM Storage TS4500 Library authorization bypass in password modification](https://junglewise.ai/threats/cve-2026-19133-ibm-storage-ts4500-library-1-1-1-6-through-1-12-0-3-could-allow-a)
- [IBM Storage TS4500 Library privilege escalation in Web UI](https://junglewise.ai/threats/cve-2026-19178-ibm-storage-ts4500-library-1-1-1-6-through-1-12-0-3-could-allow-a)
- [IBM Storage TS4500 Tape Library denial of service in email notifications](https://junglewise.ai/threats/cve-2025-36061-ibm-storage-ts4500-library-1-1-1-6-through-1-12-0-3-ibm)