Dell PowerStore CVE-2026-28265

Exploitation requires local or management-network access to a Dell PowerStore appliance using the Service user account - a special low-privileged maintenance account distinct from the administrative account, used primarily for Dell support operations. The attacker must possess valid Service user credentials or have compromised an existing authenticated session. The vulnerability is not remotely exploitable from the internet without first obtaining this local authenticated access; SSVC automatable=no confirms it cannot be scripted at scale against arbitrary targets. Exploitation is limited to PowerStore appliances running firmware prior to 4.4.0.0-2692403. No special non-default configuration is required beyond possessing the Service user credentials.

CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately reflects a local, low-complexity exploit requiring only low-privilege credentials with no user interaction. The I:H/A:H scores indicate arbitrary file modification could corrupt the storage OS, overwrite configuration, or introduce persistence - serious outcomes in a storage appliance context. However, every contextual signal points to low urgency: EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none and automatable as no, and there is no KEV listing or known POC. Real-world risk is further bounded by the operational environment: PowerStore appliances are typically segmented on dedicated storage networks with limited user populations, and the Service user is a managed maintenance account not broadly distributed. No conflict between CVSS vector and the description is observed - both consistently indicate local-only exploitation. The primary risk scenario is a malicious insider or compromised service account, not opportunistic internet attack.

An insider or attacker who has obtained Service user credentials authenticates locally to a PowerStore appliance over its management network. They submit a crafted file path containing traversal sequences (e.g., '../../etc/cron.d/malicious') through the Service user's file-handling interface, causing the appliance OS to write attacker-controlled content to a system-critical location. This could install a persistence mechanism, corrupt system configuration, or render the appliance unbootable. No public POC exists at time of analysis.