IBM TSSC/TS4500 IMC CVE-2026-5935

No special conditions - remote unauthenticated exploitation against default configurations of IBM Total Storage Service Console (TSSC) and TS4500 Intelligent Management Console (IMC) versions 9.2 through 9.6. The CVSS vector PR:N confirms no authentication is required, and UI:N indicates no user interaction is needed. Exploitation requires only network connectivity to the management console interface, typically accessible on TCP port 443 (HTTPS) or other configured management ports. However, real-world exploitation is limited by network accessibility: many enterprise deployments isolate storage management consoles on dedicated out-of-band management networks or VLAN segments not directly accessible from the internet or general corporate networks. Organizations with internet-exposed TSSC/IMC consoles or those accessible from compromised internal networks face immediate exploitation risk.

This represents a significant real-world risk despite moderate CVSS impacts (C:L/I:L/A:L). The authentication barrier is completely absent (PR:N), attack complexity is low (AC:L), and the attack vector is network-based (AV:N), creating a wide attack surface for internet-exposed or network-accessible storage management consoles. While the vulnerability only grants normal user privileges rather than root/administrator access, command execution capabilities can often be leveraged for privilege escalation, lateral movement, or data exfiltration in enterprise storage environments. The lack of CISA KEV listing and absence of public exploit code suggests this is not yet under active widespread exploitation, but the technical barrier to exploitation is low given the straightforward nature of command injection vulnerabilities. EPSS data is unavailable as this is a 2026 CVE. Organizations with internet-facing TSSC/TS4500 IMC installations face immediate risk and should prioritize remediation. The primary risk mitigation factor is that many enterprises deploy storage management consoles on isolated management networks rather than internet-accessible interfaces, significantly reducing exposure for properly segmented environments.

An unauthenticated remote attacker identifies an IBM TSSC or TS4500 IMC management console exposed on the network. The attacker crafts HTTP requests containing shell metacharacters or command separators in input fields intended for configuration parameters, such as SNMP community strings, syslog server addresses, or notification email addresses. Due to improper input validation (CWE-78), the application passes this malicious input directly to system command execution functions. The injected commands execute with normal user privileges, allowing the attacker to enumerate the system, install backdoors, exfiltrate backup metadata or configuration data, or pivot to connected storage infrastructure.