Powerscale Onefs CVE-2026-27102

CVSS 6.6 (Medium) with EPSS data absent from available intelligence suggests moderate exploitation probability in practice. The attack vector (local), privilege requirement (low), and lack of user interaction (UI:N) align with a realistic privilege escalation scenario for compromised user accounts or insider threats. The availability impact (A:H) is the most severe consequence, potentially enabling denial-of-service through process/service disruption rather than just data theft. Absence from CISA KEV and lack of public proof-of-concept code indicate this is not an active zero-day or widespread exploit-in-the-wild situation, reducing immediate enterprise threat level-however, the straightforward nature of privilege assignment bugs and Dell's broad customer base mean exploitation difficulty is likely low once an attacker has local access. For organizations with strong internal access controls and network segmentation, risk is lower; for those with permissive local access policies or multi-tenant environments, risk is elevated.

A non-privileged user with valid local credentials on a PowerScale OneFS system executes a specially crafted command or interacts with a vulnerable service to bypass privilege boundaries, allowing unprivileged code execution to escalate to higher system privileges. This could enable the attacker to modify storage configurations, access other users' data, or terminate critical services, causing denial-of-service. The low attack complexity and lack of required user interaction mean this can be automated in scripts targeting multiple systems once an attacker has compromised a single user account or gained physical access to the appliance.