What is the CVSS score of EUVD-2026-58476?

EUVD-2026-58476 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of IBM Storage Scale are affected by EUVD-2026-58476?

IBM Storage Scale Management systems (versions 5.2.3-6.0) contain a vulnerability exposing administrator credentials to local users, enabling complete takeover of storage clusters and unauthorized…. A patch is available.

How to fix or mitigate EUVD-2026-58476?

Within 24 hours, identify and enumerate all systems running IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 or 6.0.0.0 through 6.0.1.0, and immediately restrict local file system access to deployment and upgrade log files to administrative personnel only. Within 7 days, deploy the latest available security patch from IBM for all affected Storage Scale instances. Within 30 days, conduct a comprehensive review of local access controls for sensitive system files, implement encryption for log file storage where feasible, and verify successful patch deployment across all production systems.

IBM Storage Scale EUVD-2026-58476

| CVE-2026-19483 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-08-13 ibm

GHSA-7rxm-j98h-5mw7

Information Disclosure IBM Storage Scale

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local access to log files required (AV:L, PR:L); direct impact is credential disclosure only (C:H); integrity impact is downstream credential reuse, not a direct write primitive.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 18, 2026 - 11:37 NVD

HIGH MEDIUM

CVSS changed

Aug 18, 2026 - 11:37 NVD

7.1 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 21:36 vuln.today

CVE Published

Aug 13, 2026 - 20:47 nvd

HIGH 7.1

DescriptionNVD

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related to exceptions in IBM Storage Scale Management GUI.

AnalysisAI

Plaintext credential disclosure in IBM Storage Scale Management GUI allows local users to extract administrator passwords and secrets from log files generated during GUI-initiated deploy and upgrade operations. Affected are Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0. An attacker with low-privilege local access who can read GUI log files obtains admin credentials, enabling full authenticated takeover of the storage cluster. No public exploit or CISA KEV listing identified at time of analysis, though the attack is low-complexity once local access is established.

Technical ContextAI

IBM Storage Scale (formerly IBM Spectrum Scale / GPFS) is an enterprise clustered file system platform with a web-based Management GUI. The vulnerability is rooted in CWE-532 (Insertion of Sensitive Information into Log File): the GUI component fails to sanitize or redact sensitive values before writing them to log output. Two surfaces are affected - routine operational logs during Systems Deploy and Upgrade workflows (where the admin password is written in cleartext), and exception/error logs (where secrets appear in diagnostic output). CPE cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* identifies the IBM Storage Scale application across both the 5.2.3.x and 6.0.0.x/6.0.1.x release trains. The CVSS local attack vector (AV:L) reflects that exploitation requires filesystem-level access to the log directory rather than network reachability to the GUI.

RemediationAI

Apply the vendor-released patch per IBM Security Bulletin https://www.ibm.com/support/pages/node/7283308. The bulletin confirms a fix is available; an exact patched version number is not independently specified in the available intelligence - consult the advisory directly to identify the target upgrade version within the 5.2.3.x and 6.0.x streams. As an immediate compensating control while patching is scheduled, restrict filesystem read permissions on IBM Storage Scale Management GUI log directories to the minimum required service accounts, preventing low-privilege users from accessing log content. Additionally, audit existing log files in the affected version range for plaintext credential entries and rotate any admin passwords found there. If log forwarding to a SIEM or centralized log system is in use, temporarily restrict or filter those log streams to avoid credential exposure in the log aggregation tier. Avoid triggering GUI-based deploy or upgrade workflows on unpatched systems unless log access is tightly controlled.