Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to deletion of properties (CVE-2025-13465)

Summary Undici is used by IBM Storage Fusion Data Foundation in components odf-console, noobaa-core. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2025-13465 Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash version...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authorization Bypass.

Summary google.golang.org/grpc is used by IBM Storage Fusion Data Foundation, which could allow Authorization Bypass. CVE-2026-33186. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary serialize-javascript is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-34043. Vulnerability Details CVEID:CVE-2026-34043 DESCRIPTION: Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass

Summary golang.org/x/crypto is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2022-30636, CVE-2024-45337, CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181. Vulnerability Details CVEID:CVE-2022-30636 DESCRIPTION: httpTokenCacheKey uses path.Base to...

Security Bulletin: IBM Storage Defender - Data Protect critical vulnerabilities resolved in Release Defender 2.2.1/Data Protect 7.4.1

Summary IBM Storage Defender: Data Protect critical vulnerabilities resolved in release Defender 2.2.1/Data Protect 7.4.1. The vulnerabilities have been addressed in Data Protect 7.4.1, which is included in IBM Storage Defender 2.2.1 Vulnerability Details CVEID:CVE-2020-14343 DESCRIPTION: A...

Security Bulletin: Improper input validation, integer overflow, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to improper input validation, integer overflow, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message pars...

CVE-2026-19483

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...

CVE-2026-19483 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...

CVE-2026-19483

CVE-2026-19483 affects IBM Storage Scale GUI: 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 can disclose secrets (admin password) via GUI logs and exception information. The vulnerability stems from sensitive data being written to log files in the Management GUI. CVSSv3.1 base score 7.1 (HIGH), vector LV:L...

EUVD-2026-58476

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

EUVD-2026-58361

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-13460 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now addressed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now addressed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher. CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585,...

PT-2026-71868

Name of the Vulnerable Software and Affected Versions IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 IBM Storage Scale versions 6.0.0.0 through 6.0.1.0 Description Sensitive information may be exposed within the log files of the IBM Storage Scale Management GUI. Specifically, the administrato...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the Management GUI and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher. CVE-2026-19483, CVE-2026-13460 Vulnerability Details CVEID:CVE-2026-19483...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System monitoring layer are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System monitoring layer and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec library that could allow a remote attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. (CVE-2026-42583).

Summary IBM Storage Protect Server uses the netty-codec library in certain components. A vulnerability in netty could allow an attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. By providing a small malicious payload that advertises a large...