CVE-2026-76052 PUBLISHED

The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher

Assigner: ibm
Reserved: 18.08.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6

Product Status

Vendor IBM
Product Storage Scale System
Versions
  • affected from 6.2.3.0 to 6.2.3.6 (incl.)
  • affected from 7.0.0.0 to 7.0.1.0 (incl.)
Vendor IBM
Product Storage Scale
Versions
  • affected from 6.0.0.0 to 6.0.1.0 (incl.)
  • affected from 5.2.3.0 to 5.2.3.8 (incl.)

Solutions

For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=5.2.3&platform=All&function=all

For IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=6.0.1&platform=All&function=all

For IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=6.2.3&platform=All&function=all

For IBM Storage Scale System 7.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=7.0.1&platform=All&function=all

References

Problem Types

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel CWE