{"id":"CVE-2026-119670","kind":"vulnerability","aliases":["CVE-2026-119670"],"related":[],"title":"IBM Storage Copy Data Management: authenticated users can run arbitrary commands","description":"IBM Storage Copy Data Management 2.2 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.","summary":"IBM Storage Copy Data Management 2.2 does not properly validate user-supplied input. An authenticated user can use this to execute arbitrary commands with normal user privileges on the system.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Storage Copy Data Management","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-storage-copy-data-management","self-hosted","vendor"],"not_affected_if":["other-versions"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:16+00:00","updated_at":"2026-11-08T17:24:16+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T17:24:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Storage Copy Data Management: authenticated users can run arbitrary commands","impact":"high","summary":"IBM Storage Copy Data Management 2.2 does not properly validate user-supplied input. An authenticated user can use this to execute arbitrary commands with normal user privileges on the system.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-storage-copy-data-management","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"commands run as a normal user on the server","analyst_note":"Find IBM's security bulletin for CVE-2026-119670 to confirm the fixed version, the affected build range and any workaround.","how_to_check":"unknown","plain_action":"","product_name":"IBM Storage Copy Data Management","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organisations running IBM Storage Copy Data Management 2.2. An attacker needs a valid user account on the product. The sources do not describe the configuration or feature that makes an install exposed, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4517,"output_tokens":463,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119670':14A,17A '-2026':13A,16A '2.2':38B,69C 'allow':71C 'arbitrari':10A,55B,77C 'authent':6A,48B,73C 'command':11A,56B,78C 'copi':3A,26B,35B,66C 'copy':20A 'could':70C 'cve':12A,15A 'data':4A,21A,27B,36B,67C 'due':86C 'execut':54B,76C 'host':31B 'ibm':1A,18A,24B,33B,64C 'ibm-storage-copy-data-manag':23B 'improp':88C 'input':46B,93C 'manag':5A,28B,37B,68C 'management':22A 'normal':58B,80C 'privileg':60B,82C 'proper':41B 'run':9A 'self':30B 'self-host':29B 'storag':2A,25B,34B,65C 'storage':19A 'suppli':45B,92C 'system':63B,85C 'use':51B 'user':7A,44B,49B,59B,74C,81C,91C 'user-suppli':43B 'valid':42B,89C 'vendor':32B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM Storage Copy Data Management 2.2. An attacker needs a valid user account on the product. The sources do not describe the configuration or feature that makes an install exposed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ibmstoragecopydatamanagement","storagecopydatamanagement"],"ptokens":["copy","data","ibm","management","storage"],"labels":["ibmstoragecopydatamanagement","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-119670':14A,17A '-2026':13A,16A 'arbitrari':10A 'authent':6A 'command':11A 'copi':3A 'copy':20A 'cve':12A,15A 'data':4A,21A 'ibm':1A,18A 'manag':5A 'management':22A 'run':9A 'storag':2A 'storage':19A 'user':7A","search_b":"'2.2':38B 'arbitrari':55B 'authent':48B 'command':56B 'copi':26B,35B 'data':27B,36B 'execut':54B 'host':31B 'ibm':24B,33B 'ibm-storage-copy-data-manag':23B 'input':46B 'manag':28B,37B 'normal':58B 'privileg':60B 'proper':41B 'self':30B 'self-host':29B 'storag':25B,34B 'suppli':45B 'system':63B 'use':51B 'user':44B,49B,59B 'user-suppli':43B 'valid':42B 'vendor':32B","search_c":"'2.2':69C 'allow':71C 'arbitrari':77C 'authent':73C 'command':78C 'copi':66C 'could':70C 'data':67C 'due':86C 'execut':76C 'ibm':64C 'improp':88C 'input':93C 'manag':68C 'normal':80C 'privileg':82C 'storag':65C 'suppli':92C 'system':85C 'user':74C,81C,91C 'valid':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119670","severity":null,"published_at":"2026-11-08T17:16:37+00:00","modified_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}