IBM Storage TS4500 EUVD-2026-104667

Exploitation requires the attacker to already possess valid low-privilege authenticated access to the TS4500 Library management interface (PR:L) and to win a timing-dependent race condition (CWE-362) during a privileged operation, reflected in the high attack complexity (AC:H). Limiting factors: pre-existing authentication is mandatory, so this is a privilege-escalation rather than a pre-auth flaw; the race condition is non-deterministic and may require repeated attempts; affected deployments must be running firmware versions 1.1.1.6 through 1.12.0.3. No special non-default configuration is described - the race condition appears inherent to affected firmware versions.

This is a moderate-priority issue that should be patched on a normal cycle rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, base 6.8 MEDIUM) tells a consistent story: an attacker can reach the vulnerability over the network but must already hold valid low-privilege credentials (PR:L) and must win a race condition, reflected in the high attack complexity (AC:H), which materially reduces reliability of exploitation. Success yields high confidentiality and integrity impact (unauthorized administrative control of the tape library) but no availability impact (A:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was provided, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H timing dependence inherent to CWE-362 race conditions makes weaponized, widely-reusable exploits relatively unlikely in the near term. The main gating factor is the authentication requirement - this is a privilege-escalation flaw usable by an attacker who has already obtained some level of access, not a pre-auth remote takeover. Signals are internally consistent with no contradictions; the chief missing signal is EPSS, which would help prioritize against other medium-severity items.

An attacker who already holds valid low-privilege credentials to the IBM Storage TS4500 Library management interface issues carefully timed concurrent requests to trigger a race condition during a privileged operation. By winning the race window, the attacker escalates to administrative privileges, gaining full control over the tape library's configuration and stored-data access. No public exploit code is known, and the high attack complexity means exploitation requires precise timing and likely multiple attempts.