{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76052", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-18T19:51:05.172Z", "datePublished": "2026-11-08T17:31:47.800Z", "dateUpdated": "2026-11-09T14:13:01.197Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T17:31:47.800Z"}, "title": "The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Storage Scale System", "versions": [{"status": "affected", "version": "6.2.3.0", "lessThanOrEqual": "6.2.3.6", "versionType": "semver"}, {"status": "affected", "version": "7.0.0.0", "lessThanOrEqual": "7.0.1.0", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:storage_scale_system:6.2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:6.2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.1.0:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "Storage Scale", "versions": [{"status": "affected", "version": "6.0.0.0", "lessThanOrEqual": "6.0.1.0", "versionType": "semver"}, {"status": "affected", "version": "5.2.3.0", "lessThanOrEqual": "5.2.3.8", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7295211", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=5.2.3&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=6.0.1&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=6.2.3&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=7.0.1&platform=All&function=all", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:</p><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=5.2.3&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=5.2.3&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:</p><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=6.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=6.0.1&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:<br/><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=6.2.3&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=6.2.3&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:<br/><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=7.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=7.0.1&amp;platform=All&amp;function=all</a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T14:12:48.978498Z", "id": "CVE-2026-76052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T14:13:01.197Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:storage_scale_system:6.2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:6.2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Scale System", "versions": [{"status": "affected", "version": "6.2.3.0", "versionType": "semver", "lessThanOrEqual": "6.2.3.6"}, {"status": "affected", "version": "7.0.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.1.0"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Scale", "versions": [{"status": "affected", "version": "6.0.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.1.0"}, {"status": "affected", "version": "5.2.3.0", "versionType": "semver", "lessThanOrEqual": "5.2.3.8"}]}], "solutions": [{"lang": "en", "value": "For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=5.2.3&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:\n\n\n\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale&release=6.0.1&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=6.2.3&platform=All&function=all \n\n\n\n\n\n\n\nFor IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:\n https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Storage+Scale+System&release=7.0.1&platform=All&function=all", "supportingMedia": [{"type": "text/html", "value": "<p>For IBM Storage Scale 5.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 5.2.3.9 or later:</p><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=5.2.3&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=5.2.3&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale 6.0.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.0.1.1 or later:</p><p><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=6.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale&amp;release=6.0.1&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale System 6.2.3.x, IBM strongly recommends addressing the vulnerability by upgrading to 6.2.3.7 or later:<br/><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=6.2.3&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=6.2.3&amp;platform=All&amp;function=all</a></p><p></p><p>For IBM Storage Scale System 7.0.x,\u00a0IBM strongly recommends addressing the vulnerability by upgrading to 7.0.1.1 or later:<br/><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=7.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&amp;product=ibm/StorageSoftware/IBM+Storage+Scale+System&amp;release=7.0.1&amp;platform=All&amp;function=all</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7295211", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T17:31:47.800Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T14:12:48.978498Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-11-09T14:12:57.186Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-76052", "state": "PUBLISHED", "dateUpdated": "2026-11-08T17:31:47.800Z", "dateReserved": "2026-08-18T19:51:05.172Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T17:31:47.800Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:storage_scale_system:6.2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:6.2.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_scale_system:7.0.1.0:*:*:*:*:*:*:*"], "product": "Storage Scale System", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.2.3.6", "status": "affected", "version": "6.2.3.0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.1.0", "status": "affected", "version": "7.0.0.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_scale:5.2.3.0:*:*:*:*:*:*:*"], "product": "Storage Scale", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.0.1.0", "status": "affected", "version": "6.0.0.0", "versionType": "semver"}, {"lessThanOrEqual": "5.2.3.8", "status": "affected", "version": "5.2.3.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the REST API."}], "id": "CVE-2026-76052", "lastModified": "2026-11-09T15:17:21.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76052", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T14:12:48.978498Z", "version": "2.0.3"}}]}, "published": "2026-11-08T18:17:04.827", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7295211"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}