What is the CVSS score of CVE-2025-32747?

CVE-2025-32747 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell PowerFlex Manager are affected by CVE-2025-32747?

Dell PowerFlex Manager versions 4.6.2 and earlier contain a privilege escalation flaw (CVE-2025-32747) enabling storage infrastructure compromise by any internal user with minimal system access.. A patch is available.

How to fix or mitigate CVE-2025-32747?

Within 24 hours, identify and document all Dell PowerFlex Manager deployments running version 4.6.2 or earlier, noting appliance and rack variants. Within 7 days, apply the vendor-released patch to all affected systems using the latest available version, testing in staging first for large environments. Within 30 days, confirm all instances are running patched versions per the vendor advisory, validate monitoring and alerting remain functional, and review security logs from the past 90 days for signs of suspicious privilege escalation or unauthorized administrative activity.

Dell PowerFlex Manager CVE-2025-32747

EUVD-2025-209918 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-05-22 dell

GHSA-g24f-w862-679m

Dell Information Disclosure Powerflex Manager Appliance Powerflex Manager Rack Powerflex Manager

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an existing low-privilege local session (AV:L, PR:L) with no user interaction; incorrect privilege assignment yields full host control, so C:H/I:H/A:H, scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 16:22 NVD

5.3 (MEDIUM) 7.8 (HIGH)

Patch available

May 26, 2026 - 14:16 EUVD

Analysis Generated

May 22, 2026 - 14:03 vuln.today

DescriptionNVD

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a local, low-privileged user to gain higher privileges through an Incorrect Privilege Assignment (CWE-266) flaw. An attacker who already has a foothold on the management host can abuse mis-scoped privileges to achieve full confidentiality, integrity, and availability impact on the system. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.

Technical ContextAI

Dell PowerFlex Manager is the management control plane for Dell's PowerFlex software-defined storage/hyperconverged infrastructure, shipped both as a hardened virtual/appliance image (PowerFlex Manager Appliance, tracked under 'IC' intelligent-catalog build numbers) and as the rack-integrated management stack (PowerFlex Manager Rack). The root cause is CWE-266 Incorrect Privilege Assignment: a resource, process, service, or account within the management stack is granted more privilege than its intended low-privilege role should hold, so a user operating at a low privilege level inherits capabilities reserved for a higher-privilege context. The affected CPEs are cpe:2.3:a:dell:powerflex_manager, powerflex_manager_(appliance), and powerflex_manager_(rack), confirming all three product packagings are in scope.

RemediationAI

Patch available per vendor advisory - upgrade to a fixed release: PowerFlex Manager (Rack) 3.8.3.0 or later (the 3.7.8.0 line addresses earlier fixed builds), and PowerFlex Manager (Appliance) intelligent catalog IC 48.383.00 or later (IC 48.378.00 for the earlier fixed build); for the base PowerFlex Manager product upgrade beyond 4.6.2 to the vendor-designated fixed build. Apply the updates described in Dell DSA-2025-435 (Rack, https://www.dell.com/support/kbdoc/en-us/000391568/) and DSA-2025-434 (Appliance, https://www.dell.com/support/kbdoc/en-us/000391392/), confirming the exact target build for your deployment in the advisory since these are bundled security updates. Until patched, reduce exposure with compensating controls that fit a local-only privilege-escalation flaw: restrict and audit interactive/local and shell access to the PowerFlex Manager host so only trusted administrators can obtain the low-privilege foothold the exploit requires (trade-off: may slow legitimate operational access), enforce least-privilege and unique accounts for operators rather than shared low-priv logins, and monitor the management host for unexpected privilege changes or anomalous local process/account activity. These do not remove the flaw and should be treated as interim measures only.