{"api_version":"1","generated_at":"2026-11-10T12:04:20+00:00","cve":"CVE-2026-119670","urls":{"html":"https://cve.report/CVE-2026-119670","api":"https://cve.report/api/cve/CVE-2026-119670.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-119670","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-119670"},"summary":{"title":"Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management","description":"IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-11-08 17:16:37","updated_at":"2026-11-09 19:16:43"},"problem_types":["CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295286","name":"https://www.ibm.com/support/pages/node/7295286","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-119670","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119670","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Storage Copy Data Management","version":"affected 2.2.0.0 2.3.1.0 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Affected Versions Fixing LevelPlatformLink to Fix and Instructions2.2.0.0 - 2.3.1.02.3.2.0Linux \n\n\n https://www.ibm.com/support/pages/node/7288658","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"119670","cve":"CVE-2026-119670","epss":"0.003740000","percentile":"0.315830000","score_date":"2026-11-09","updated_at":"2026-11-10 00:05:33"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-119670","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T18:59:33.372406Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-09T18:59:40.976Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:storage_copy_data_management:2.3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_copy_data_management:2.2.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"Storage Copy Data Management","vendor":"IBM","versions":[{"lessThanOrEqual":"2.3.1.0","status":"affected","version":"2.2.0.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.</p>"}],"value":"IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T17:08:16.439Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295286"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><table><tbody><tr><td>Affected Versions</td><td> Fixing Level</td><td>Platform</td><td>Link to Fix and Instructions</td></tr><tr><td>2.2.0.0 - 2.3.1.0</td><td>2.3.2.0</td><td>Linux \n<div></div></td><td><div><a href=\"https://www.ibm.com/support/pages/node/7288658\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7288658</a></div></td></tr></tbody></table></div>"}],"value":"Affected Versions Fixing LevelPlatformLink to Fix and Instructions2.2.0.0 - 2.3.1.02.3.2.0Linux \n\n\n https://www.ibm.com/support/pages/node/7288658"}],"source":{"discovery":"UNKNOWN"},"title":"Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-119670","datePublished":"2026-11-08T17:08:42.028Z","dateReserved":"2026-10-30T14:06:41.382Z","dateUpdated":"2026-11-09T18:59:40.976Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 17:16:37","lastModifiedDate":"2026-11-09 19:16:43","problem_types":["CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-09T18:59:33.372406Z","id":"CVE-2026-119670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"119670","Ordinal":"1","Title":"Vulnerabilities in spring-context, logback-core and Another JSON","CVE":"CVE-2026-119670","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"119670","Ordinal":"1","NoteData":"IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.","Type":"Description","Title":"Vulnerabilities in spring-context, logback-core and Another JSON"}]}}}