IBM Storage Scale EUVD-2026-58476

Exploitation requires low-privilege local access (PR:L per CVSS) to the host running the IBM Storage Scale Management GUI, specifically read access to the GUI log directory. The credential disclosure only occurs when GUI-initiated Systems Deploy or Upgrade operations have been executed on the affected version - if no such operations have run, the admin password may not be present in logs, though exception-based secret disclosure remains a separate and persistent risk path. Limiting factors: no network exploitation path exists (AV:L); an attacker must already have local OS-level access and the ability to read log files; exploitation of the upgrade-log path depends on those workflows having been used while the vulnerable version was installed. Non-default log directory permissions that restrict read access to root or a dedicated service account would prevent low-privilege exploitation.

The provided CVSS 7.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) captures the core risk well: low-complexity, privilege-escalating credential theft on a local system. EPSS data is not included in the supplied intelligence, so exploitation probability cannot be quantified numerically. No KEV listing and no POC are identified, indicating this is not yet under active mass exploitation. Real-world risk is moderate-to-high in environments where multiple users or service accounts share access to the Storage Scale management host, or where log files are forwarded to shared SIEM/log aggregation systems with insufficiently restricted access controls - in such cases, the attack surface broadens substantially beyond strict local-only. The I:H in IBM's CVSS vector represents downstream integrity impact from credential reuse rather than a direct write primitive, which is a common but debatable scoring choice; the direct vulnerability is a pure disclosure (C:H). Organizations running affected versions with broad log-reader access should treat this as high priority despite the absence of public exploit activity.

An attacker who has already established a low-privilege foothold on the IBM Storage Scale management host - for example, via a compromised service account or lateral movement from another system - reads the Management GUI log files stored on the local filesystem. During a prior or ongoing GUI-driven upgrade operation, the admin password was written to the log in cleartext; the attacker extracts it and authenticates to the Storage Scale Management GUI as administrator, gaining full control over the clustered file system and its data. No public POC has been identified, but the attack requires no special tooling beyond filesystem read access and a text search.