{"id":"CVE-2026-5935","state":"PUBLISHED","title":"TSSC/IMC is vulnerable to OS Command Injection","description":"IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.","publishedAt":"2026-04-22T23:30:08.449Z","updatedAt":"2026-04-23T13:57:14.969Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"ibm"},"assigner":"ibm","products":["IBM Total Storage Service Console (TSSC) / TS4500 IMC"],"affected":[{"vendor":"IBM","product":"Total Storage Service Console (TSSC) / TS4500 IMC","versions":[{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.6.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7270127"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5935.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5935","state":"PUBLISHED","datePublished":"2026-04-22T23:30:08.449Z","dateUpdated":"2026-04-23T13:57:14.969Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-04-09T00:42:21.168Z"},"containers":{"cna":{"title":"TSSC/IMC is vulnerable to OS Command Injection","descriptions":[{"lang":"en","value":"IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input."}],"affected":[{"vendor":"IBM","product":"Total Storage Service Console (TSSC) / TS4500 IMC","versions":[{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.6.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:total_storage_service_console_tssc__ts4500_imc:9.2.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7270127","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseSeverity":"HIGH","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-04-22T23:30:08.449Z"},"solutions":[{"lang":"en","value":"Affected Product(s)Version(s)Remediation/Fix/InstructionsTotal Storage Service Console (TSSC) / TS4500 IMC9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,Upgrade to 9.4.31/9.6.15\n\nDownload patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\nTotal Storage Service Console (TSSC) / TS4500 IMC9.4.31,  9.6.15Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.\n\nPlease see instructions below.\n\n\n\n\n\nFor information on how to download the patch please refer to the following page:  Available Updates https://www.ibm.com/docs/en/tssc","supportingMedia":[{"type":"text/html","base64":false,"value":"<div><div><table><tbody><tr><td>Affected Product(s)</td><td>Version(s)</td><td>Remediation/Fix/Instructions</td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.14, 9.4.21, 9.4.26, 9.6.10, 9.5.8,</td><td><p>Upgrade to 9.4.31/9.6.15</p><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr><tr><td>Total Storage Service Console (TSSC) / TS4500 IMC</td><td>9.4.31,&nbsp; 9.6.15</td><td><p>Download patch 9.X.X_FixOSCommandInjection_2026-04-06 or 9.X.X_FixOSCommandInjection_2026-04-06 and execute on TSSC/IMC system.</p><p>Please see instructions below.</p></td></tr></tbody></table></div></div><p>For information on how to download the patch please refer to the following page:&nbsp;<a href=\"https://www.ibm.com/docs/en/tssc?topic=acquisition-available-updates\" rel=\"nofollow\">Available Updates</a></p>"}]}],"x_generator":{"engine":"ibm-cvegen"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-23T13:57:07.349653Z","id":"CVE-2026-5935","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-23T13:57:14.969Z"}}]}}}