Dell PowerFlex Manager
CVE-2026-35069
HIGH
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent management network and low-privileged app account required (AV:A, PR:L); SQLi against backend DB yields high C/I/A with no scope change.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
AnalysisAI
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL commands that the application processes against its backend database, leading to script injection and potential compromise of confidentiality, integrity, and availability. The flaw is reported by Dell with no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Technical ContextAI
PowerFlex Manager is Dell's management plane for the PowerFlex software-defined storage platform (cpe:2.3:a:dell:powerflex), exposing a web/management interface to administrators on the storage management network. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL statements without adequate parameterization or escaping, allowing an authenticated user to alter query semantics. The CVE description notes the downstream effect is script injection, suggesting injected SQL values are subsequently rendered in a web context, chaining SQLi with stored XSS.
RemediationAI
Patch available per vendor advisory - apply the PowerFlex Manager update described in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities); confirm the exact fixed build with Dell support because the published CVE record shows the affected version field as a placeholder. Until the patch is deployed, compensating controls include restricting the PowerFlex Manager UI/API to a dedicated management VLAN reachable only from jump hosts (mitigates the AV:A reachability requirement), tightening RBAC so only the minimum operator accounts hold PowerFlex roles and rotating credentials of any low-privileged service accounts (reduces likelihood of PR:L being satisfied), and enabling enhanced web/database logging to detect anomalous query patterns. Trade-offs: tighter network segmentation may break monitoring or automation tooling that currently reaches the manager directly, and credential rotation requires coordinated updates to any integration accounts.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today