IBM Storage Console Flaw: Unauthenticated RCE Risk

The National Vulnerability Database has disclosed CVE-2026-5935, a high-severity vulnerability impacting IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2, 9.3, 9.4, 9.5, and 9.6. This flaw, rated CVSS 7.3, allows an unauthenticated attacker to execute arbitrary commands with normal user privileges. The root cause is improper validation of user-supplied input, a classic CWE-78 (OS Command Injection) scenario.

This isn’t a complex exploit. The fact that it’s unauthenticated and grants command execution is what makes it dangerous. An attacker doesn’t need to bypass authentication to gain a foothold. While the privileges are ‘normal user,’ this often provides enough access to pivot, escalate privileges, or disrupt critical storage operations. For storage infrastructure, even a limited compromise can have devastating data availability and integrity implications.

Defenders need to treat any unauthenticated RCE on critical infrastructure as a top priority. This vulnerability puts core storage systems at risk, which are often overlooked in standard perimeter security. The attacker’s calculus here is simple: find an exposed IBM TSSC or TS4500 IMC, send a crafted request, and you’re in. This is a direct path to internal network access and potential data manipulation.