Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

1 vulnerability found for Storage Scale System by IBM

CVE-2026-76052 (GCVE-0-2026-76052)

Vulnerability from cvelistv5 – Published: 2026-11-08 17:31 – Updated: 2026-11-09 14:13

Title

The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher

Summary

IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 14:12 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7295211	vendor-advisorypatch

Impacted products

2 products

Vendor	Product	Version
IBM	Storage Scale System	Affected: 6.2.3.0 , ≤ 6.2.3.6 (semver) Affected: 7.0.0.0 , ≤ 7.0.1.0 (semver) cpe:2.3:a:ibm:storage_scale_system:6.2.3.0:::::::* cpe:2.3:a:ibm:storage_scale_system:6.2.3.6:::::::* cpe:2.3:a:ibm:storage_scale_system:7.0.0.0:::::::* cpe:2.3:a:ibm:storage_scale_system:7.0.1.0:::::::*
IBM	Storage Scale	Affected: 6.0.0.0 , ≤ 6.0.1.0 (semver) Affected: 5.2.3.0 , ≤ 5.2.3.8 (semver) cpe:2.3:a:ibm:storage_scale:5.2.3.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T14:12:48.978498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T14:13:01.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:storage_scale_system:6.2.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_scale_system:6.2.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_scale_system:7.0.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_scale_system:7.0.1.0:*:*:*:*:*:*:*"
          ],
          "product": "Storage Scale System",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "6.2.3.6",
              "status": "affected",
              "version": "6.2.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.1.0",
              "status": "affected",
              "version": "7.0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*"
          ],
          "product": "Storage Scale",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "6.0.1.0",
              "status": "affected",
              "version": "6.0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.2.3.8",
              "status": "affected",
              "version": "5.2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.\u003c/p\u003e"
            }
          ],
          "value": "IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T17:31:47.800Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7295211"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale\u0026amp;release=5.2.3\u0026amp;platform=All\u0026amp;function=all\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale\u0026amp;release=5.2.3\u0026amp;platform=All\u0026amp;function=all\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eFor IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale\u0026amp;release=6.0.1\u0026amp;platform=All\u0026amp;function=all\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale\u0026amp;release=6.0.1\u0026amp;platform=All\u0026amp;function=all\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eFor IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026amp;release=6.2.3\u0026amp;platform=All\u0026amp;function=all\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026amp;release=6.2.3\u0026amp;platform=All\u0026amp;function=all\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eFor IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026amp;release=7.0.1\u0026amp;platform=All\u0026amp;function=all\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026amp;release=7.0.1\u0026amp;platform=All\u0026amp;function=all\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026product=ibm/StorageSoftware/IBM+Storage+Scale\u0026release=5.2.3\u0026platform=All\u0026function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026product=ibm/StorageSoftware/IBM+Storage+Scale\u0026release=6.0.1\u0026platform=All\u0026function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026release=6.2.3\u0026platform=All\u0026function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage\u0026product=ibm/StorageSoftware/IBM+Storage+Scale+System\u0026release=7.0.1\u0026platform=All\u0026function=all"
        }
      ],
      "title": "The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-76052",
    "datePublished": "2026-11-08T17:31:47.800Z",
    "dateReserved": "2026-08-18T19:51:05.172Z",
    "dateUpdated": "2026-11-09T14:13:01.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}