CVE-2026-5935 is a high severity flaw (CVSS 7.3) in IBM Total Storage Service Console (TSSC) and TS4500 IMC versions 9.2 to 9.6. An unauthenticated user could run commands with normal user privileges. Upgrade to 9.4.31 or 9.6.15, or apply the IBM patch.
What's affected
- IBM TSSC and TS4500 IMC 9.2, 9.3, 9.4, 9.5 and 9.6.
- IBM lists affected builds including 9.4.14, 9.4.21, 9.4.26, 9.6.10 and 9.5.8.
- Fixed: upgrade to 9.4.31 or 9.6.15, or download patch 9.X.X_FixOSCommandInjection_2026-04-06 and run it on the system.
- IBM lists no workarounds or mitigations.
How to check if you're exposed
Read the TSSC or IMC version on the console. If it falls in the affected builds, follow IBM's instructions to download and apply the patch. Then check who on the network can reach the console.
Firmware is outside what a code scan covers, but the Gold directory is a quick way to look up the CVE record and the weakness class when you write the change ticket.
What to do now
- Download the IBM patch or upgrade to 9.4.31 or 9.6.15.
- Follow IBM's patch instructions on each TSSC and IMC system.
- Restrict network access to the console to administrators.
- Review system logs for unexpected commands.
Keep a short list of every device of this model on your network, with its firmware version and where it sits. Embedded gear is easy to forget, and a list is what lets you act quickly when a vendor ships an update.
Why it matters
This is CWE-78 (OS Command Injection). Input from a user was not validated before it reached a command. IBM says an unauthenticated user could run arbitrary commands with normal user privileges. Management consoles for storage gear often sit on trusted networks, which makes isolation worth checking.
The CISA KEV flag is false.
Storage service consoles are rarely patched on the same rhythm as servers, because vendor tooling and support contracts get in the way. IBM publishes the patch as a downloadable fix with instructions, so plan a maintenance slot and check the instructions before you start. The advisory also gives a change history, so look for later revisions of the bulletin.
Quick check
Is there a workaround?
IBM lists none. Use the patch or upgrade.
Sources
Last reviewed: 19 October 2026.
