SB2026082615 - Multiple vulnerabilities in IBM Storage Protect Plus
Published: August 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2026-26007)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. A remote attacker can provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup.
2) Improper handling of exceptional conditions (CVE-ID: CVE-2026-27448)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security-sensitive behavior.
The vulnerability exists due to improper exception handling in set_tlsext_servername_callback callbacks when handling TLS connections. A remote attacker can trigger an unhandled exception in a user-provided callback to bypass security-sensitive behavior.
Exploitation is possible only if an application relies on this callback for security-sensitive decisions.
3) Buffer overflow (CVE-ID: CVE-2026-27459)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists because the callback provided to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, causing pyOpenSSL to overflow an OpenSSL-provided buffer. A remote attacker can pass specially crafted data to the application, trigger a buffer overflow and execute arbitrary code on the target system.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-29526)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to the Faccessat function can incorrectly report that a file is accessible, when called with a non-zero flags parameter. An attacker can bypass implemented security restrictions.
5) Improper Certificate Validation (CVE-ID: CVE-2026-34073)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate name constraints validation.
The vulnerability exists due to improper certificate validation in the X.509 certificate validation logic when validating a peer name against a wildcard SAN certificate chain. A remote attacker can present a crafted certificate chain to bypass certificate name constraints validation.
Exploitation requires an uncommon X.509 topology involving an excluded subtree constraint that matches the peer name.
Remediation
Install update from vendor's website.