Dell PowerFlex Manager
CVE-2026-35066
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Network-reachable management API, low-priv account suffices (PR:L), no UI; primary impact is service outage (A:H) with minor integrity side effects and no confidentiality loss.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
AnalysisAI
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service condition and tamper with integrity-sensitive operations against the software-defined storage management plane. Dell disclosed the issue in advisory DSA-2026-066, and at the time of analysis no public exploit has been identified and the CVE is not on the CISA KEV list.
Technical ContextAI
PowerFlex Manager is the orchestration and lifecycle-management component of Dell's PowerFlex software-defined storage platform, exposing REST APIs and a web UI used to provision nodes, manage protection domains, and configure storage policies. The root cause is CWE-284 (Improper Access Control), meaning an authorization check is missing or insufficient on a privileged code path, so an authenticated user whose role should not grant a given capability is nevertheless allowed to invoke it. The CPE cpe:2.3:a:dell:powerflex:*:*:*:*:*:*:*:* indicates the management application itself rather than the underlying SDS data services.
RemediationAI
Patch available per Dell vendor advisory DSA-2026-066 - administrators should consult https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities for the exact fixed PowerFlex Manager version applicable to their deployment and upgrade through the standard PowerFlex lifecycle workflow. As compensating controls until patching, restrict PowerFlex Manager API and UI reachability to a dedicated management VLAN or jump host (trade-off: breaks any direct admin/automation access from user networks), audit and minimize accounts that hold any PowerFlex role since PR:L is the exploitation threshold (trade-off: tighter role assignments may require workflow changes for operators), and enable monitoring/alerting on unexpected service-stop or configuration-change API calls so a DoS attempt is detected quickly (trade-off: added log volume).
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today