CVE-2026-19178: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in IBM Storage TS4500 Library

IBM Storage TS4500 Library versions from 1.1.1.6 up to and including 1.12.0.3 contain a race condition (CWE-362) that can be exploited by a remote authenticated attacker. This flaw arises from improper synchronization when accessing shared resources, enabling privilege escalation to administrative levels. The vulnerability requires the attacker to have low-level privileges and network access, with no user interaction needed. The CVSS vector indicates a network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts but no availability impact.

An attacker with remote authenticated access and low privileges can exploit this race condition to escalate privileges to administrative level, potentially compromising confidentiality and integrity of the system. There is no indication of impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict remote authenticated access to trusted users only and monitor for suspicious privilege escalation attempts.