IBM Storage Scale vulnerabilities

8 CVEs affecting IBM Storage Scale, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19483, published 2026-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-13460, published 2026-08-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API…
CVE-2025-1137, published 2025-05-10. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
CVE-2023-38002, published 2024-04-30. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208.
CVE-2024-31892, published 2024-12-14. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization…
CVE-2025-36104, published 2025-07-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.
CVE-2026-19483, published 2026-08-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM…
CVE-2024-31891, published 2024-12-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command line access to the 'scalemgmt' user can…
CVE-2025-14604, published 2026-03-03. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigger additional permissions for resources…