EUVD-2026-26190Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible management interface requires low-privileged auth; SSRF yields only partial confidentiality disclosure with no integrity, availability, or scope-change impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
5DescriptionCVE.org
Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
AnalysisAI
Server-Side Request Forgery in Dell Disk Library for Mainframe (DLm8700 and DLm2700, versions prior to 7.0.1.0) enables a low-privileged remote attacker to coerce the appliance into issuing server-side HTTP requests to arbitrary internal or external resources. The vulnerability is scored CVSS 4.3 Medium and carries an EPSS of 0.01% (1st percentile), reflecting negligible real-world exploitation probability. No public exploit code exists and CISA SSVC assessment confirms no active exploitation and non-automatable attack path.
Technical ContextAI
Dell Disk Library for Mainframe is an enterprise virtual tape library (VTL) appliance designed to emulate IBM 3592 and similar mainframe tape drives, used in large-scale IBM Z/mainframe backup and data-management environments. The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a class of flaw where the server fetches remote resources based on attacker-controlled URL input without sufficient validation or allowlist enforcement - effectively allowing the appliance to be used as a network proxy. Affected products are confirmed by CPE identifiers cpe:2.3:a:dell:disk_library_for_mainframe_dlm8700 and cpe:2.3:a:dell:disk_library_for_mainframe_dlm2700, covering all versions of both the DLm8700 and DLm2700 product lines prior to 7.0.1.0. The SSRF surface most likely resides in the DLm management web interface, which handles remote administrative connections over the network.
RemediationAI
Upgrade Dell Disk Library for Mainframe DLm8700 and DLm2700 to version 7.0.1.0 or later, as documented in Dell Security Advisory DSA-2026-091 at https://www.dell.com/support/kbdoc/en-us/000458131/dsa-2026-091-security-update-for-dell-disk-library-for-mainframe-vulnerabilities. The patch is confirmed available from the vendor per both Dell's advisory and EUVD-2026-26190. As a compensating control pending upgrade, restrict network-layer access to the DLm management interface to only trusted administrative hosts using firewall ACLs or network segmentation - this does not eliminate the flaw but removes the attacker's ability to reach the vulnerable endpoint without already being on a trusted network segment, raising the effective privilege bar. Additionally, audit low-privileged DLm accounts and revoke any unnecessary access; since PR:L is required, minimizing the number of accounts with management interface access directly reduces exposure.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today