What is the CVSS score of CVE-2026-27102?

CVE-2026-27102 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27102?

Yes, a patch is available for CVE-2026-27102. Update the affected software to the latest version immediately.

Dell CVE-2026-27102

EUVD-2026-20447 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-04-08 dell

GHSA-jw3m-5wwm-qcph

Dell Information Disclosure

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

9.10.1.7

EUVD ID Assigned

Apr 08, 2026 - 13:16 euvd

EUVD-2026-20447

Analysis Generated

Apr 08, 2026 - 13:16 vuln.today

CVE Published

Apr 08, 2026 - 12:11 nvd

MEDIUM 6.6

DescriptionCVE.org

Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

AnalysisAI

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.1 contain an incorrect privilege assignment vulnerability allowing local authenticated attackers to escalate privileges with low complexity, potentially achieving partial confidentiality and integrity compromise alongside high availability impact. No public exploit code or active exploitation has been identified at the time of analysis, though the local attack vector and straightforward exploitation path (AC:L) indicate moderate real-world risk for environments where local access controls are weak.

Technical ContextAI

This vulnerability (CWE-266: Incorrect Privilege Assignment) stems from improper permission model implementation in PowerScale OneFS, likely affecting file system or process privilege boundaries. The local attack vector (AV:L) indicates an attacker must already have local system access-typically via compromised user accounts or physical access. The low privilege requirement (PR:L) means any non-root user can trigger the flaw without requiring special system roles, suggesting the vulnerable code path is reachable from standard user contexts. The vulnerability affects Dell's distributed NAS/storage platform across multiple minor versions within two major release branches (9.x), suggesting a systemic privilege assignment error rather than an isolated edge case.

RemediationAI

Vendor-released patch: Dell PowerScale OneFS version 9.10.1.7 or later. Users running versions 9.5.0.0-9.10.1.6 should upgrade to 9.10.1.7 or later; users on 9.11.0.0-9.13.0.1 should upgrade to the next patched release in their respective branch (consult Dell advisory for exact versions). Interim mitigation includes restricting local system access through strong authentication, disabling unnecessary local user accounts, and implementing OS-level privilege separation where possible. Consult Dell's official security advisory at https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities for detailed upgrade procedures and any platform-specific deployment notes.