{"id":"CVE-2026-14375","kind":"vulnerability","aliases":["CVE-2026-14375"],"related":[],"title":"IBM Storage Scale: TLS certificate checks missing, enabling forged responses","description":"IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.","summary":"IBM Storage Scale does not properly validate TLS certificates when it talks to the GUI interfaces of remote clusters. A network attacker positioned in the middle can inject forged JSON responses.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpfs","ibm-storage-scale","infrastructure","self-hosted"],"not_affected_if":["no-remote-cluster-gui"],"how_to_check":"- Check the installed IBM Storage Scale version with `mmdiag --version` on a cluster node; the affected range is `5.2.3.0` through `5.2.3.8` and `6.0.1.0`.\n- Confirm whether remote cluster GUI connections are configured in your deployment; unknown if the sources say more.","fix":"- Move to a fixed IBM Storage Scale release; the sources do not name the fixed version, so unknown.","status":"open","published_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:54+00:00","updated_at":"2026-11-08T18:22:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed IBM Storage Scale release; the sources do not name the fixed version, so unknown.","reach":"network","title":"IBM Storage Scale: TLS certificate checks missing, enabling forged responses","impact":"low","summary":"IBM Storage Scale does not properly validate TLS certificates when it talks to the GUI interfaces of remote clusters. A network attacker positioned in the middle can inject forged JSON responses.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-storage-scale","self-hosted","gpfs"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker forges JSON responses from remote cluster GUI interfaces","analyst_note":"Find the IBM security bulletin for CVE-2026-14375 to confirm the fixed version and whether remote cluster GUI use is the only trigger.","how_to_check":"- Check the installed IBM Storage Scale version with `mmdiag --version` on a cluster node; the affected range is `5.2.3.0` through `5.2.3.8` and `6.0.1.0`.\n- Confirm whether remote cluster GUI connections are configured in your deployment; unknown if the sources say more.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-cluster-gui"],"who_is_affected":"Organizations running IBM Storage Scale 5.2.3.0 through 5.2.3.8 or 6.0.1.0 that use remote cluster GUI communication are exposed. An attacker must be able to intercept traffic between clusters, so systems without remote cluster GUI links are less exposed. unknown whether other configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4573,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14375':13A,16A '-2026':12A,15A '5.2.3.0':60C '5.2.3.8':62C '6.0.1.0':64C 'allow':83C 'attack':47B,85C 'certif':5A,34B,72C 'check':6A 'cluster':44B,78C 'communic':75C 'could':82C 'cve':11A,14A 'enabl':8A 'forg':9A,54B,88C 'gpfs':17B 'gui':40B,79C 'host':25B 'ibm':1A,19B,26B,57C 'ibm-storage-scal':18B 'improp':69C 'infrastructur':22B 'inject':53B,87C 'interfac':41B,80C 'json':55B,89C 'man':92C 'middl':51B,95C 'miss':7A 'network':46B 'posit':48B 'proper':31B 'remot':43B,77C 'respons':10A,56B,90C 'scale':3A,21B,28B,59C 'self':24B 'self-host':23B 'storag':2A,20B,27B,58C 'talk':37B 'techniqu':96C 'tls':4A,33B,71C 'use':91C 'valid':32B,67C,70C,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Storage Scale 5.2.3.0 through 5.2.3.8 or 6.0.1.0 that use remote cluster GUI communication are exposed. An attacker must be able to intercept traffic between clusters, so systems without remote cluster GUI links are less exposed. unknown whether other configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gpfs","ibmstoragescale","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-14375':13A,16A '-2026':12A,15A 'certif':5A 'check':6A 'cve':11A,14A 'enabl':8A 'forg':9A 'ibm':1A 'miss':7A 'respons':10A 'scale':3A 'storag':2A 'tls':4A","search_b":"'attack':47B 'certif':34B 'cluster':44B 'forg':54B 'gpfs':17B 'gui':40B 'host':25B 'ibm':19B,26B 'ibm-storage-scal':18B 'infrastructur':22B 'inject':53B 'interfac':41B 'json':55B 'middl':51B 'network':46B 'posit':48B 'proper':31B 'remot':43B 'respons':56B 'scale':21B,28B 'self':24B 'self-host':23B 'storag':20B,27B 'talk':37B 'tls':33B 'valid':32B","search_c":"'5.2.3.0':60C '5.2.3.8':62C '6.0.1.0':64C 'allow':83C 'attack':85C 'certif':72C 'cluster':78C 'communic':75C 'could':82C 'forg':88C 'gui':79C 'ibm':57C 'improp':69C 'inject':87C 'interfac':80C 'json':89C 'man':92C 'middl':95C 'remot':77C 'respons':90C 'scale':59C 'storag':58C 'techniqu':96C 'tls':71C 'use':91C 'valid':67C,70C,73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14375","severity":null,"published_at":"2026-11-08T18:17:01+00:00","modified_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}