CVE-2026-63688

Summary

This vulnerability allows an unauthenticated attacker to gain unauthorized access to storage backend administrator credentials, potentially leading to full control over storage arrays.

Exploitability

Exploitation is relatively easy given the missing authentication for critical functions, requiring only network access to the affected gRPC server.

Blast radius

If exploited, the impact is high, as it grants full access to all registered storage arrays, compromising data security and integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CSM version 1.18.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.