Storage Manager CVE-2026-23772

Requires authenticated access as a low-privileged local user (PR:L) on a Windows server where Dell Storage Manager - Replay Manager version 8.0 is installed and running. The vulnerability is specific to the Replay Manager component for Microsoft Servers, indicating exploitation likely requires the attacker to interact with this service locally on the host. No user interaction required (UI:N) once local authenticated access is established. Attack complexity is Low (AC:L), suggesting exploitation does not depend on race conditions, specialized configurations, or environmental variables beyond the vulnerable software being present. Organizations not running Dell Storage Manager 8.0 or those where local user access to storage management servers is tightly restricted through least-privilege access controls face substantially lower risk. The local attack vector (AV:L) fundamentally limits exploitation to scenarios where an attacker has already achieved initial compromise through separate means, making this primarily a privilege escalation vector in multi-stage attacks rather than an initial access vulnerability.

Real-world risk is MODERATE despite the High CVSS 7.3 score. The local attack vector (AV:L) and requirement for low-privileged authentication (PR:L) significantly constrain the attack surface compared to network-exploitable vulnerabilities. An attacker must first gain legitimate local access through separate compromise or insider access. However, once local access exists, the Low attack complexity (AC:L) and no user interaction requirement (UI:N) make exploitation straightforward for a skilled attacker. The high integrity and availability impact (I:H/A:H) with limited confidentiality impact (C:L) suggests the vulnerability enables system modification, service disruption, or persistence mechanisms more than data exfiltration. No EPSS score, CISA KEV listing, or public exploit code identified, indicating this is not currently being exploited at scale in the wild. For organizations running Dell Storage Manager 8.0 on domain-joined Windows servers, this represents a realistic privilege escalation vector in multi-stage attacks where initial access has been achieved through phishing, credential theft, or other MITRE ATT&CK initial access techniques. Prioritize patching on production storage management servers with sensitive data access.

An attacker who has compromised a low-privileged domain user account (via phishing or credential theft) authenticates to a Windows server running Dell Storage Manager - Replay Manager 8.0. The attacker executes a local exploit targeting the improper privilege management vulnerability in the Replay Manager service or installed components, manipulating COM interfaces, service permissions, or configuration files to escalate privileges to NT AUTHORITY\SYSTEM or local Administrator. With elevated privileges, the attacker modifies storage replication configurations to exfiltrate backup data, deploys persistent backdoors, or disrupts storage operations across the enterprise environment.