Dell PowerFlex Manager
CVE-2026-35065
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector matches a management-plane endpoint, missing auth gives PR:N/UI:N, and vendor-listed RCE plus DoS plus disclosure justify H/H/H impacts.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) [Versions], contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.
AnalysisAI
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke privileged operations without credentials, yielding code execution, denial of service, information disclosure, tampering, and unauthorized access. No public exploit identified at time of analysis, and the affected version range was not populated in the source advisory placeholder. Dell self-reported the issue under DSA-2026-066.
Technical ContextAI
PowerFlex Manager is the management plane for Dell's PowerFlex software-defined storage platform (CPE cpe:2.3:a:dell:powerflex), typically deployed inside storage/management VLANs alongside SDS/SDC nodes. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning one or more sensitive endpoints - likely an administrative API, management RPC, or inter-node service - accept requests without verifying the caller's identity. Because PowerFlex Manager orchestrates cluster lifecycle, configuration, and credential operations, an unauthenticated handler in that surface is sufficient to pivot into the full impact set listed (RCE, DoS, info disclosure/tampering).
RemediationAI
Patch available per vendor advisory: apply the PowerFlex software update referenced in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities), upgrading to the fixed build Dell lists for your installed PowerFlex Manager version (exact fix version not included in the CVE record and must be read from the DSA). Until patched, restrict the PowerFlex Manager management interface to a dedicated, ACL-controlled storage/management VLAN reachable only from administrative jump hosts - this neutralizes the AV:A vector but breaks any monitoring tools that scrape the manager from general networks. Additional compensating controls: block unsolicited traffic to PowerFlex Manager TCP listeners from tenant/workload subnets at the top-of-rack switch, and tighten host-based firewalls on the manager nodes to permit only known SDS/SDC peer IPs.
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today