Dell PowerFlex Manager
CVE-2026-35067
HIGH
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent-network reachability to the management plane (AV:A), valid low-tier account required (PR:L), no user interaction, and full administrative takeover of storage cluster yields C:H/I:H/A:H.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.
AnalysisAI
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass access controls and gain unauthorized elevated access to the management plane. The CVSS 8.0 (High) score reflects significant confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and EPSS rates exploitation probability at only 0.13% (3rd percentile). CISA SSVC classifies exploitation as 'none' with non-automatable attack characteristics, indicating no observed real-world abuse despite the meaningful technical severity.
Technical ContextAI
Dell PowerFlex Manager is the centralized management interface for Dell's PowerFlex software-defined storage platform (formerly VxFlex OS / ScaleIO), which provides block storage across clustered commodity servers in enterprise data centers and private cloud deployments. The underlying weakness is CWE-284 (Improper Access Control), a broad class of flaw where the application fails to correctly enforce authorization policies on a function, resource, or API endpoint - allowing a user authenticated at one privilege level to perform actions reserved for higher-privileged roles. The CPE string cpe:2.3:a:dell:powerflex:*:*:*:*:*:*:*:* indicates all PowerFlex versions are in scope pending vendor clarification, and the 'Authentication Bypass' tag suggests the access control gap may permit role or session boundary circumvention rather than full unauthenticated access.
RemediationAI
Patch available per vendor advisory - apply the fixed PowerFlex Manager release documented in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities); exact fix versions are not reproduced in the NVD record and must be read directly from the Dell knowledge base article. Until patched, compensating controls should leverage the AV:A constraint by isolating the PowerFlex management network on a dedicated VLAN unreachable from general user subnets, restricting management-plane access to a small set of jump hosts via firewall ACLs (side effect: legitimate admin workflows from ad-hoc workstations break), and auditing PowerFlex Manager role assignments to revoke low-privilege accounts that do not require ongoing access (side effect: may interrupt monitoring or reporting tooling that runs under reduced-privilege service accounts). Enable and centrally collect PowerFlex Manager audit logs to detect anomalous role transitions or API calls from low-privileged principals.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today