CVE-2026-5935

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 23, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-593548.8In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabCVE-2026-593556.1In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uCVE-2026-593576.5Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusiCVE-2026-593587.6Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid uCVE-2026-59369.8An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinatCVE-2026-59375.5Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argumenCVE-2026-59385.5Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI frCVE-2026-59395.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting iCVE-2026-59405.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crasCVE-2026-59417.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leadiCVE-2026-59425.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operationCVE-2026-59437.8Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered do
CVE-2026-5935: Critical severity, CVSS 9.8 | Vulnix