Unisphere for PowerMax CVE-2026-101217

Exploitation requires an authenticated low-privileged account (PR:L) with network access to the Dell Unisphere for PowerMax virtual appliance running version 9.2.4.x. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the attacker must already possess valid credentials to the appliance's management interface - this authentication requirement is the primary limiting factor and means fully unauthenticated exploitation is not supported by the data. Impact is confined to confidentiality (reading of restricted files); there is no integrity or availability impact. Risk is highest where the appliance is reachable by many lower-tier users; it is reduced where management-plane access is network-restricted to trusted administrators.

This is a moderate-severity information disclosure flaw (CVSS 6.5) whose CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) tells a consistent story: network-reachable, low attack complexity, no user interaction, but requiring an already-authenticated low-privileged account (PR:L), and impacting confidentiality only (C:H, I:N, A:N). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so by the precision rules there is no public exploit identified at time of analysis and no evidence of active exploitation. The authentication requirement meaningfully lowers real-world risk versus an unauthenticated path traversal - an attacker must first obtain valid (even if limited) credentials to the appliance. This is a genuine but not emergency priority: worth patching on a normal cycle, especially where the appliance is exposed to broad user populations, rather than a drop-everything KEV-style threat. Key missing signals (EPSS, KEV, POC) should be re-checked against live feeds before final triage, as their absence here reflects the supplied data only, not a confirmed negative.

An attacker who already holds a low-privileged account on the Unisphere for PowerMax virtual appliance sends crafted requests containing directory-traversal sequences (e.g. ../) to a vulnerable endpoint, causing the application to read files outside its intended directory. This yields disclosure of sensitive files such as configuration data or credentials. No public proof-of-concept was provided in the available intelligence.