CVE-2026-5935
Command Injection in IBM TSSC/TS4500 IMC Allows Unauthorized Execution
Publication date: 2026-04-23
Last updated on: 2026-04-23
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | total_storage_service_console | From 9.2 (inc) to 9.6 (inc) |
| ibm | ts4500_integrated_management_console | From 9.2 (inc) to 9.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5935 is an OS Command Injection vulnerability affecting IBM's Total Storage Service Console (TSSC) and TS4500 Integrated Management Console (IMC) versions 9.2 through 9.6.
It allows an unauthenticated attacker to execute arbitrary operating system commands with normal user privileges on the affected system.
This happens because the software improperly validates user-supplied input via an HTTP/HTTPS endpoint.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary OS commands remotely without any authentication or user interaction.
This can lead to impacts on confidentiality, integrity, and availability of the affected system.
- Confidentiality impact: unauthorized access to sensitive data.
- Integrity impact: unauthorized modification of data or system state.
- Availability impact: potential disruption or denial of service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-5935 vulnerability, you should apply the patches or upgrade your IBM Total Storage Service Console (TSSC) or TS4500 Integrated Management Console (IMC) to fixed versions.
- Upgrade to fixed releases: 9.4.31, 9.6.15, or apply specific patch versions 9.4.14, 9.4.21, 9.4.26, 9.6.10, and 9.5.8 with the patch named 9.X.X_FixOSCommandInjection_2026-04-06.
No workarounds or alternative mitigations are available, so applying the official patch as per IBM’s instructions is essential.
Users should download and execute the provided patch on their TSSC/IMC systems promptly to prevent exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-5935 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The CVE-2026-5935 vulnerability is an OS Command Injection issue exploitable via an HTTP/HTTPS endpoint on IBM Total Storage Service Console (TSSC) and TS4500 Integrated Management Console (IMC) versions 9.2 through 9.6.
Detection typically involves monitoring for suspicious HTTP/HTTPS requests that attempt to inject OS commands through user-supplied input parameters. However, no specific detection commands or signatures are provided in the available information.
Since the vulnerability allows unauthenticated command execution, network monitoring tools could be used to inspect incoming HTTP/HTTPS traffic for unusual or malformed requests targeting the TSSC/IMC management interfaces.
IBM recommends applying patches or upgrading to fixed versions to remediate the vulnerability, as no workarounds or mitigations are available.
Because no explicit detection commands or scripts are provided, it is advised to check the version of your TSSC/IMC installations and verify if they are at or above the fixed versions (9.4.31, 9.6.15, or patched versions).