Dell PowerFlex Manager
CVE-2026-32804
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Adjacent management-network reachability (AV:A), no auth or interaction per CWE-287 bypass, and high integrity/availability impact on storage management without disclosed confidentiality loss.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain unauthorized access to the management plane, with high impact to integrity and availability of the software-defined storage fabric. Dell's DSA-2026-066 advisory addresses this and other PowerFlex flaws; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have layer-2/adjacent network reachability to PowerFlex Manager (AV:A) - typically presence on the storage/management VLAN via a compromised host on that segment, a misconfigured trunk, or a flat network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed: CVSS 8.1 (High) with AV:A/AC:L/PR:N/UI:N/C:N/I:H/A:H reflects easy, unauthenticated abuse once on the adjacent network and serious integrity/availability impact on storage management - a meaningful concern because PowerFlex underpins production storage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains a foothold on the same management VLAN - for example via a compromised hypervisor host, monitoring appliance, or admin workstation - sends crafted requests to the PowerFlex Manager API that bypass authentication and act as a privileged user. From there they could alter storage configuration, disrupt protection domains, or take management actions impacting integrity and availability of the storage fabric; no public exploit identified at time of analysis. |
| Remediation | Patch available per vendor advisory: apply the PowerFlex Manager update referenced in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities) as soon as a maintenance window permits, since the exact fixed version is not enumerated in the public CVE record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Dell PowerFlex Manager deployments and document their network connectivity, particularly access from adjacent network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Share
External POC / Exploit Code
Leaving vuln.today