IBM Storage Copy Data Management version 2.2 contains a flaw that allows an authenticated user to send specially crafted input that bypasses validation and is executed by the system under normal user rights. The vulnerability enables arbitrary command execution, giving the user the ability to run commands on the host machine with the privileges that the authenticated account holds.

Affected IBM Storage Copy Data Management releases include versions 2.2.0.0 through 2.3.2.0 for Linux platforms. These are identified by the CPE strings listed for IBM Storage Copy Data Management with versions 2.2.x and 2.3.x.

The CVSS score of 6.3 indicates a moderate severity vulnerability. Exploitation requires authentication, so the attack is limited to accounts that already have access to the Storage Copy Data Management service. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread public exploitation is currently unknown, but the impact remains significant for any system using the affected versions.