Dell PowerFlex Manager
CVE-2026-32804
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Adjacent management-network reachability (AV:A), no auth or interaction per CWE-287 bypass, and high integrity/availability impact on storage management without disclosed confidentiality loss.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain unauthorized access to the management plane, with high impact to integrity and availability of the software-defined storage fabric. Dell's DSA-2026-066 advisory addresses this and other PowerFlex flaws; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Affected version range is not enumerated in the public record, which constrains accurate exposure scoping.
Technical ContextAI
PowerFlex Manager is the centralized management application for Dell's PowerFlex software-defined storage (formerly VxFlex/ScaleIO), orchestrating nodes, protection domains, and storage pools (CPE cpe:2.3:a:dell:powerflex). The root cause is classed as CWE-287 Improper Authentication, meaning an authentication routine accepts a request that should have been rejected - typically a missing check on a privileged API path, a flaw in token/session validation, or trust placed in a client-supplied identity claim. The CVSS Adjacent (AV:A) vector indicates exposure on the same broadcast/management segment rather than the open internet, which is consistent with PowerFlex Manager's typical deployment on an isolated storage/management VLAN.
RemediationAI
Patch available per vendor advisory: apply the PowerFlex Manager update referenced in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities) as soon as a maintenance window permits, since the exact fixed version is not enumerated in the public CVE record. Until patched, place PowerFlex Manager on a dedicated management VLAN reachable only from jump hosts and storage administrators, enforce L2/L3 ACLs that block adjacent reachability from hypervisor guest, tenant, and general user segments (trade-off: may require updating automation/monitoring source IPs), require VPN or bastion access for administrators, and increase monitoring on PowerFlex Manager authentication and API endpoints for anomalous requests. Avoid exposing the management interface on shared subnets even temporarily.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today