CVE-2025-14604 Privilege escalation in Storage Scale

What is CVE-2025-14604?

CVE-2025-14604 is a medium-severity vulnerability in IBM Storage Scale, published on 3 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigger additional permissions for resources in a way that allows that resource to be executed by unintended actors.

Weakness: CWE-732

Which versions are affected by CVE-2025-14604?

It affects 1 product.

Products include Ibm Storage Scale.

How do I fix CVE-2025-14604?

No fix has been published for CVE-2025-14604 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-14604 being exploited?

There is no known exploitation of CVE-2025-14604 in the wild and no public exploit code.

Other vulnerabilities in IBM Storage Scale

• CVE-2024-31891 IBM Storage Scale privilege escalation High 7.8
• CVE-2026-13460 Hardcoded credentials in Storage Scale High 7.5
• CVE-2025-1137 IBM Storage Scale command injection High 7.5
• CVE-2024-31892 IBM Storage Scale SQL injection High 7.5
• CVE-2026-19483 Information disclosure in Storage Scale High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q86w-wgjw-p4mp.