CVE-2026-5935

CVE-2026-5935 is a command injection vulnerability affecting IBM Total Storage Service Console (TSSC) and TS4500 Intelligent Management Console (IMC) versions 9.2 through 9.6. The flaw stems from improper validation of user-supplied input, allowing unauthenticated attackers to execute arbitrary commands with standard user privileges on affected systems. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning exploitation is straightforward for threat actors. Potential impacts include confidentiality loss, integrity compromise, and availability disruption, though the damage is limited to normal user-level privileges rather than administrative access. This vulnerability is currently listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog and appears on the Active Hot List, indicating active exploitation in the wild. However, the extremely low EPSS score of 0.00047 suggests minimal prevalence in real-world exploitation attempts relative to other disclosed vulnerabilities. Organizations running TSSC or IMC within the affected version range should prioritize patching given the demonstrated active exploitation risk despite low statistical exploitation probability.