CVE-2026-5935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5935", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-04-09T00:42:21.168Z", "datePublished": "2026-04-22T23:30:08.449Z", "dateUpdated": "2026-04-23T13:57:14.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:30:08.449Z"}, "title": "TSSC/IMC is vulnerable to OS Command Injection", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Total Storage Service Console (TSSC) / TS4500 IMC", "versions": [{"status": "affected", "version": "9.2.0", "lessThanOrEqual": "9.6.0", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC\u00a0could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC&nbsp;could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7270127", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Affected Product(s)Version(s)Remediation/Fix/InstructionsTotal Storage Service Console (TSSC) / TS4500 IMC9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,Upgrade to 9.4.31/9.6.15\n\nDownload patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\nTotal Storage Service Console (TSSC) / TS4500 IMC9.4.31,\u00a0 9.6.15Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\n\n\n\n\nFor information on how to download the patch please refer to the following page:\u00a0 Available Updates https://www.ibm.com/docs/en/tssc", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div><table><tbody><tr><td>Affected Product(s)</td><td>Version(s)</td><td>Remediation/Fix/Instructions</td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,</td><td><p>Upgrade to 9.4.31/9.6.15</p><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.31,&nbsp; 9.6.15</td><td><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr></tbody></table></div></div><p>For information on how to download the patch please refer to the following page:&nbsp;<a href=\"https://www.ibm.com/docs/en/tssc?topic=acquisition-available-updates\" rel=\"nofollow\">Available Updates</a></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T13:57:07.349653Z", "id": "CVE-2026-5935", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:57:14.969Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T13:57:07.349653Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:57:11.757Z"}}], "cna": {"title": "TSSC/IMC is vulnerable to OS Command Injection", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Total Storage Service Console (TSSC) / TS4500 IMC", "versions": [{"status": "affected", "version": "9.2.0", "versionType": "semver", "lessThanOrEqual": "9.6.0"}]}], "solutions": [{"lang": "en", "value": "Affected Product(s)Version(s)Remediation/Fix/InstructionsTotal Storage Service Console (TSSC) / TS4500 IMC9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,Upgrade to 9.4.31/9.6.15\n\nDownload patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\nTotal Storage Service Console (TSSC) / TS4500 IMC9.4.31,\u00a0 9.6.15Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\n\n\n\n\nFor information on how to download the patch please refer to the following page:\u00a0 Available Updates https://www.ibm.com/docs/en/tssc", "supportingMedia": [{"type": "text/html", "value": "<div><div><table><tbody><tr><td>Affected Product(s)</td><td>Version(s)</td><td>Remediation/Fix/Instructions</td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,</td><td><p>Upgrade to 9.4.31/9.6.15</p><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.31,&nbsp; 9.6.15</td><td><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr></tbody></table></div></div><p>For information on how to download the patch please refer to the following page:&nbsp;<a href=\"https://www.ibm.com/docs/en/tssc?topic=acquisition-available-updates\" rel=\"nofollow\">Available Updates</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7270127", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC\u00a0could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC&nbsp;could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-22T23:30:08.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5935", "state": "PUBLISHED", "dateUpdated": "2026-04-23T13:57:14.969Z", "dateReserved": "2026-04-09T00:42:21.168Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-22T23:30:08.449Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2.0:*:*:*:*:*:*:*"], "product": "Total Storage Service Console (TSSC) / TS4500 IMC", "vendor": "IBM", "versions": [{"lessThanOrEqual": "9.6.0", "status": "affected", "version": "9.2.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:total_storage_service_console:9.2:*:*:*:*:*:*:*", "matchCriteriaId": "4B9351F0-CCAE-4FF1-B4F7-6927E14CEAE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:total_storage_service_console:9.3:*:*:*:*:*:*:*", "matchCriteriaId": "6C515F00-4712-45D3-84E6-180F7740AE4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:total_storage_service_console:9.4:*:*:*:*:*:*:*", "matchCriteriaId": "05359041-FF28-458C-9193-53293C03A1C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:total_storage_service_console:9.5:*:*:*:*:*:*:*", "matchCriteriaId": "28BD55FD-194E-4996-AB4F-880300042D59", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:total_storage_service_console:9.6:*:*:*:*:*:*:*", "matchCriteriaId": "9321F67D-80EC-4CC6-B642-955C0864C410", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:ts4500_imc:9.2:*:*:*:*:*:*:*", "matchCriteriaId": "116EE78F-D060-4F75-813C-54264734537B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:ts4500_imc:9.3:*:*:*:*:*:*:*", "matchCriteriaId": "451E8164-7B55-4F04-A079-CBB07DE5E53F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:ts4500_imc:9.4:*:*:*:*:*:*:*", "matchCriteriaId": "5E8C3809-E867-4C07-89E4-808C932E7BAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:ts4500_imc:9.5:*:*:*:*:*:*:*", "matchCriteriaId": "01FE4835-0707-4CEE-A6C5-7F87FCF67D46", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:ts4500_imc:9.6:*:*:*:*:*:*:*", "matchCriteriaId": "17832436-EC1B-44D7-86CD-99D0B2BE9112", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC\u00a0could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input."}, {"lang": "es", "value": "IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC podr\u00eda permitir a un usuario no autenticado ejecutar comandos arbitrarios con privilegios de usuario normal en el sistema debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario."}], "id": "CVE-2026-5935", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5935", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T13:57:07.349653Z", "version": "2.0.3"}}]}, "published": "2026-04-23T00:16:46.900", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7270127"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.2.0,9.6.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Total Storage Service Console (TSSC) / TS4500 IMC", "source": "cna", "vendor": "IBM"}, "product": "total_storage_service_console_tssc__ts4500_imc", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-28T15:14:00.351573+00:00", "value": {"mitigation_remediation": ["Download and install the IBM patch 9.X.X_FixOSCommandInjection_2026-04-06 for the affected TSSC/IMC system", "Upgrade the TSSC/IMC to the fixed versions 9.4.31 (for 9.4.x) or 9.6.15 (for 9.6.x)", "Check the IBM update portal and apply any additional updates recommended by IBM for the TSSC/IMC product"], "summary": {"action": "Patch Now", "impact": "OS Command Injection (Remote Code Execution)"}, "threat_synthesis": {"affected_systems": "IBM Total Storage Service Console (TSSC) / TS4500 IMC versions 9.2, 9.3, 9.4, 9.5, and 9.6 are impacted. The fix is available in version 9.4.31 for the 9.4.x line and version 9.6.15 for the 9.6.x line. Earlier releases without these updates remain vulnerable.", "description_and_impact": "A flaw in IBM Total Storage Service Console (TSSC) / TS4500 IMC allows an unauthenticated user to inject operating system commands, enabling execution of arbitrary commands with the privileges of the normal user context. This vulnerability is categorized as CWE\u201178 and can grant an attacker unauthorized command execution on the affected system.", "risk_and_exploitability": "The CVSS score of 7.3 indicates a high-severity risk. Although the EPSS score is below 1%, suggesting low probability of exploitation at the time of this assessment, the vulnerability is not listed in the CISA KEV catalog. It is likely exploitable via the management or web interface of TSSC/IMC, whereby an unauthenticated connections can trigger the command injection. The impact is the unauthorized execution of system commands, potentially leading to further compromise or denial of service."}}}}, "created": "2026-04-28T05:45:23.113934+00:00", "updated": "2026-04-28T15:15:34.210987+00:00", "vendors": ["ibm", "ibm$PRODUCT$total_storage_service_console_tssc__ts4500_imc"]}