PowerFlex Manager
CVE-2026-35068
MEDIUM
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Adjacent vector and low-privilege requirement confirmed by description; read-only SQL injection yields only partial confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to information disclosure.
AnalysisAI
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insufficiently sanitized SQL command input. The vulnerability requires both network adjacency and existing low-level credentials, limiting its reach considerably from an opportunistic threat standpoint. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis; the CVSS score of 3.5 (Low) reflects the constrained attack surface.
Technical ContextAI
Dell PowerFlex Manager is the software-defined infrastructure management platform for Dell's PowerFlex (formerly VxFlex/ScaleIO) hyperconverged and disaggregated storage systems. CWE-89 (Improper Neutralization of Special Elements in an SQL Command) identifies the root cause: one or more application endpoints fail to adequately parameterize or escape user-controlled input before incorporating it into SQL queries, permitting an attacker to alter query logic. The CPE string cpe:2.3:a:dell:powerflex:*:*:*:*:*:*:*:* indicates the flaw resides in the PowerFlex software application tier, not in firmware or the underlying storage kernel. The adjacent-network attack vector (AV:A) implies the vulnerable interface is exposed only within a local segment, VLAN, or management network, consistent with the typical deployment of PowerFlex Manager on isolated infrastructure management networks.
RemediationAI
Consult Dell Security Advisory DSA-2026-066 at https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities to identify the exact patched version applicable to your deployment; the input data does not supply a specific fixed version number so 'Patch available per vendor advisory' is the most accurate characterization of patch status at this time. As a compensating control prior to patching, restrict access to the PowerFlex Manager interface to the minimum set of accounts and source IP ranges necessary - specifically, enforce role-based access controls so that low-privileged accounts cannot reach the vulnerable SQL-backed endpoint. Network-layer segmentation of the PowerFlex management VLAN to prevent lateral reach from general corporate segments will reduce exposure further, consistent with the AV:A constraint already limiting exploitation to adjacent-network actors. Monitor PowerFlex Manager application and database logs for anomalous or oversized SQL query patterns as a detection measure. No side effects from patch application are documented in the available data.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today