CVE-2023-50948 is a medium severity (CVSS 6.5) hard-coded credentials flaw in IBM Storage Fusion HCI 2.1.0 through 2.6.1. IBM says the preferred fix is to upgrade to IBM Storage Fusion HCI 2.7.1, and its bulletin lists no workarounds. Plan the upgrade rather than waiting for a mitigation.
What's affected
IBM's bulletin lists IBM Storage Fusion HCI 2.1.0 through 2.6.1 as affected. The NVD record describes the product as containing hard-coded credentials that it uses for inbound authentication, for outbound communication to external components, or to encrypt internal data. IBM tracks it as X-Force ID 275671.
The fixed version named in the bulletin is IBM Storage Fusion HCI 2.7.1. According to the bulletin, the 2.7.1 install and upgrade procedures update the default AFM credentials. If you cannot upgrade yet, the bulletin says to contact IBM Support.
CVSS for this entry is 6.5 (Medium) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
How to check if you're exposed
Find the installed Storage Fusion HCI version through your normal IBM console or support tooling, and compare it with the range 2.1.0 through 2.6.1. I am not going to guess at a command for this appliance, so follow the steps in the IBM bulletin linked below.
The NVD vector is AV:A, which means an attacker needs adjacent network access. That makes network placement part of your exposure review: who can reach the management and storage networks of the cluster?
What to do now
- Check the installed version of IBM Storage Fusion HCI against the affected range.
- Schedule the upgrade to 2.7.1 using the procedure IBM links from the bulletin.
- If the upgrade must wait, contact IBM Support as the bulletin advises, and keep the cluster networks limited to the staff and systems that need them.
- After upgrading, confirm with IBM guidance that the default AFM credentials were updated, and record the change in your asset notes.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-259 is the use of a hard-coded password. A credential baked into a product ships to every customer, so anyone who learns it can try it against every installation. Fixing it means replacing the shared secret with per-install credentials that the operator sets or rotates during setup.
CWE-798 covers hard-coded credentials of any kind, including keys used for encryption or for talking to other components. Because the secret lives in the product itself, the only real fix is a software update that stops relying on it.
The weakness here is simple. A secret that ships inside a product is the same secret on every installation. IBM's bulletin gives a confidentiality impact only, which matches the vector: high confidentiality impact, no integrity or availability impact.
Neither the record nor IBM's bulletin reports exploitation, and the severity is moderate because of the adjacent network requirement. Still, hard-coded credentials are cheap to abuse once known, so treating the upgrade as routine work with a deadline is sensible.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Is there a workaround for CVE-2023-50948?
IBM's bulletin lists no workarounds or mitigations. It names the upgrade to 2.7.1 as the preferred remediation and says to contact IBM Support if you cannot upgrade yet.
Which scoring version does IBM use?
The IBM bulletin shows a CVSS v3.0 vector, while the NVD record uses v3.1. Both give a base score of 6.5.
Sources
Last reviewed: 19 October 2026.
