CVE-2026-14375 PUBLISHED

The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Assigner: ibm
Reserved: 01.07.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.9

Product Status

Vendor IBM
Product Storage Scale
Versions
  • Version 6.0.1.0 is affected
  • affected from 5.2.3.0 to 5.2.3.8 (incl.)

Solutions

For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=5.2.3&platform=All&function=all

For IBM Storage Scale 6.0.1.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=6.0.1&platform=All&function=all

References

Problem Types

  • CWE-295 Improper Certificate Validation CWE