Dell PowerFlex Manager
CVE-2026-35069
HIGH
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent management network and low-privileged app account required (AV:A, PR:L); SQLi against backend DB yields high C/I/A with no scope change.
Primary rating from Vendor (dell).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
AnalysisAI
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL commands that the application processes against its backend database, leading to script injection and potential compromise of confidentiality, integrity, and availability. The flaw is reported by Dell with no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network adjacency to the PowerFlex management interface - i.e., a foothold on the same broadcast/L2 management segment as PowerFlex Manager (AV:A), not arbitrary internet reachability - and (2) valid low-privileged credentials to the PowerFlex Manager application (PR:L); UI:N means no victim interaction is needed for the SQLi itself, though the downstream script-injection impact requires another operator to view the affected page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.0 (High) reflects High impact across C/I/A combined with adjacent-network attack vector (AV:A), low complexity (AC:L), and low privileges (PR:L) - a credentialed insider or compromised low-tier account on the management network is the threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privileged PowerFlex Manager credentials (e.g., a help-desk or read-only operator account) and a foothold on the storage management VLAN submits a crafted parameter to a vulnerable PowerFlex Manager endpoint; the value is concatenated into a backend SQL query, allowing the attacker to read or modify management database contents and persist an injected payload that is later rendered as script in another operator's browser. No public exploit code is identified, so the attack would require independent vulnerability research against the patched binary. |
| Remediation | Patch available per vendor advisory - apply the PowerFlex Manager update described in Dell DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities); confirm the exact fixed build with Dell support because the published CVE record shows the affected version field as a placeholder. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Dell PowerFlex Manager deployments and restrict network access to this service to trusted networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Share
External POC / Exploit Code
Leaving vuln.today