IBM Total Storage Service Console (TSSC) / TS4500 IMC versions 9.2.0 to 9.6 contain an OS command injection vulnerability (CWE-78) identified as CVE-2026-5935. This flaw arises from improper neutralization of special elements in user input, enabling unauthenticated users to execute arbitrary commands on the underlying system with normal user privileges. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published by IBM as of the current data.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary OS commands with normal user privileges on affected IBM TSSC / TS4500 IMC systems. This can lead to partial compromise of system confidentiality, integrity, and availability. However, the attacker does not gain elevated privileges beyond normal user level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected service and monitor for suspicious activity. Do not assume the vulnerability is mitigated without vendor confirmation.