Dell PowerFlex Manager
CVE-2026-35065
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector matches a management-plane endpoint, missing auth gives PR:N/UI:N, and vendor-listed RCE plus DoS plus disclosure justify H/H/H impacts.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) [Versions], contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.
AnalysisAI
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke privileged operations without credentials, yielding code execution, denial of service, information disclosure, tampering, and unauthorized access. No public exploit identified at time of analysis, and the affected version range was not populated in the source advisory placeholder. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have layer-2/adjacent network reachability to the PowerFlex Manager management interface (CVSS AV:A) - internet-only attackers cannot reach it unless the manager has been mis-exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent and point to a high real-world priority within reachable network segments: CVSS 3.1 base 8.8 with AV:A/AC:L/PR:N/UI:N and H/H/H impacts, CWE-306 (a class historically prone to trivial exploitation once the endpoint is known), and vendor-confirmed impact spanning RCE and DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on any host in the storage/management VLAN (e.g., via a phished admin workstation or a compromised neighboring VM) sends a crafted request directly to the unauthenticated PowerFlex Manager endpoint. With no credentials required, they invoke the privileged function to execute commands on the manager, exfiltrate cluster configuration, or disrupt storage services - no public POC is currently identified, but CWE-306 issues are typically straightforward to reproduce once the vulnerable endpoint is named. |
| Remediation | Patch available per vendor advisory: apply the PowerFlex software update referenced in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities), upgrading to the fixed build Dell lists for your installed PowerFlex Manager version (exact fix version not included in the CVE record and must be read from the DSA). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Dell PowerFlex Manager installations and immediately restrict network access to trusted administrative networks only; enable comprehensive audit logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Share
External POC / Exploit Code
Leaving vuln.today