IBM Total Storage Service Console (TSSC) / TS4500 IMC versions 9.2.0 to 9.6 contain an OS command injection vulnerability (CWE-78) identified as CVE-2026-5935. This flaw arises from improper neutralization of special elements in user input, enabling unauthenticated attackers to execute arbitrary commands with normal user privileges on the affected system. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or mitigation has been published by IBM, and the product is not a cloud service, so remediation depends on vendor updates.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary operating system commands with the privileges of a normal user on the affected IBM TSSC / TS4500 IMC system. This could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, the attacker does not gain elevated privileges beyond normal user level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor IBM security advisories closely. Until a patch is available, consider restricting network access to the affected service and applying any recommended vendor workarounds once released.