IBM RSCT EUVD-2026-63096

No special configuration or elevated privileges are required once network adjacency is established - the CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms unauthenticated exploitation with low complexity from the adjacent network. The sole prerequisite is that the attacker occupies the same network segment, subnet, or broadcast domain as the RSCT management interface; this typically means access to the cluster's private interconnect or management VLAN. Internet-based exploitation is not possible in standard deployments. The limiting factors are: (1) network adjacency requirement, which confines risk to internal or co-located attackers; (2) impact is availability-only - no data exfiltration or integrity compromise is achievable through this vector; and (3) no specific RSCT feature or non-default configuration is identified as a prerequisite beyond the service being reachable.

The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.5) accurately reflects a bounded but meaningful risk: unauthenticated exploitation is possible but only from an adjacent network segment, which is the dominant risk-limiting factor. EPSS data was not included in the provided intelligence, so quantitative exploitation probability cannot be assessed. This CVE is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed active exploitation at time of analysis. The practical blast radius depends heavily on whether the RSCT management network is properly segmented - operators who have exposed cluster management interfaces to broader enterprise or guest VLANs face meaningfully higher risk than those with strict network isolation. The combination of AV:A constraint, DoS-only impact (no data exposure), and absence of known exploitation makes this a moderate-priority finding; it warrants patching on a normal patch cycle rather than emergency response, unless RSCT availability is directly load-bearing for critical production workloads.

An attacker with foothold on the cluster management network - for example, via a compromised node or misconfigured VLAN - sends a specially crafted malformed request to the RSCT service endpoint. The lack of input bounds enforcement (CWE-770) causes the service to allocate resources without limit, exhausting available memory or threads and crashing the cluster manager. This disrupts cluster coordination, potentially taking dependent workloads or failover mechanisms offline. No public proof-of-concept is known, but the low attack complexity (AC:L) suggests the trigger condition is not difficult to reproduce once network access is established.