Security Bulletin: IBM Storage Protect Operations Center is affected by a prototype pollution vulnerability (CVE-2026-29063).

Summary IBM Storage Protect Server OSSM and ObjectAgent components are affected by a prototype pollution vulnerability. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to prototype pollution due to Immutable.js (CVE-2026-29063)

Summary IBM Storage Protect for Space Management uses Immutable.js as part of its web-based user interface components. A prototype pollution vulnerability in Immutable.js could allow an attacker to modify object prototypes through specially crafted input processed by affected APIs, potentially...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec library that could allow a remote attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. (CVE-2026-42583).

Summary IBM Storage Protect Server uses the netty-codec library in certain components. A vulnerability in netty could allow an attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. By providing a small malicious payload that advertises a large...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow an attacker to inject malicious CRLF sequences into request URIs, resulting in HTTP request smuggling, protocol desynchronization, and the execution of unintended HTTP ...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse jetty-ee10-jaspi library that could cause broken access controls, potentially allowing unauthorized access or privilege escalation. (CVE-2026-5795).

Summary IBM Storage Protect Server uses the Eclipse jetty-ee10-jaspi library in certain components. A vulnerability in Jetty could cause authentication context being retained in ThreadLocal variables and inadvertently reused by subsequent requests processed on the same thread. This can lead to...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes ( CVE-2026-34478)

Summary IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. This issue has been fixed in this release by incorporating the Apache...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp (CVE-2025-36097)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp. This issue has been addressed in this release...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect Client and Virtual Environments include IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF,...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and xlink:href attribut...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-27970)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular internationalization i18n pipeline could allow attacker-controlled JavaScript to execute if a malicious translation file is processed. Successful...

Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storage Protect...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF, potentially...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to denial-of-service attack due to commons-lang-2.6.jar (CVE-2025-48924)

Summary Apache Commons lang 2.6 library is used by the IBM Storage Protect Client, BA Client and Data Protection for VMware component. An uncontrolled recursion flaw in ClassUtils.getClass can cause a StackOverflowError when processing specially crafted long inputs, potentially resulting in a...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to stored cross-site scripting due to Angular (CVE-2025-66412)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A stored cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to bypass Angular's built-in security sanitization and execute malicious scripts...

Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage Protect for Spa...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin:IBM Storage Protect Operations Center is affected by a security configuration vulnerability(CVE-2025-14923)

Summary BM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow a security configuration attack under specific conditions. Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Serv...

Security Bulletin:IBM Storage Protect Operations Center is affected by a hardcoded protection mechanism vulnerability(CVE-2025-14917, CWE-1393).

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow security configuration attack caused by use of hardcoded protection mechanism for LTPA keys, that could impact the security of the affected...

Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that may allow inadequate validation and processing of maliciously crafted input. (CVE-2026-4410, CWE-400)

Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow inadequate validation and processing of maliciously crafted input during request handling operations, that could impact the security of the...