CVE-2026-19178

Received Received - Intake

Race Condition in IBM Storage TS4500 Library Grants Admin Access

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: IBM Corporation

Description

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-19178

EUVD

EUVD-2026-104667

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Storage	TS4500 Library 1.1.1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3. A remote authenticated attacker could exploit this to gain unauthorized administrative privileges.

Impact Analysis

An attacker could take control of the storage library, potentially accessing or modifying sensitive data stored on it. This could lead to data breaches or system disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA, which mandate strict data protection controls.

Mitigation Strategies

Update IBM Storage TS4500 Library to a version beyond 1.12.0.3 to address the race condition vulnerability. Ensure only authenticated users have administrative access and monitor for unusual privilege escalation attempts.

Hi! I’m here to help you understand CVE-2026-19178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70