What is the CVSS score of CVE-2026-35071?

CVE-2026-35071 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PowerScale InsightIQ are affected by CVE-2026-35071?

Dell PowerScale InsightIQ versions 6.0.0 through 6.2.0 contain a command injection vulnerability that allows local administrators to execute arbitrary system commands and escape container isolation…. A patch is available.

How to fix or mitigate CVE-2026-35071?

Within 24 hours: Identify all Dell PowerScale InsightIQ deployments running versions 6.0.0 through 6.2.0 and document current version inventory. Within 7 days: Review Dell security advisory DSA-2026-208 and contact Dell support to confirm patch timeline and interim mitigation availability. Within 30 days: Apply vendor-released patch to all affected systems as soon as available, prioritizing production storage environments; if patch remains unavailable, implement access controls restricting InsightIQ administrative console access to a minimal set of trusted administrators pending remediation.

PowerScale InsightIQ CVE-2026-35071

EUVD-2026-29469 HIGH

OS Command Injection (CWE-78)

2026-05-12 dell

GHSA-q3jj-rxg6-8h9m

Dell Command Injection

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 12, 2026 - 15:02 EUVD

Analysis Generated

May 12, 2026 - 14:15 vuln.today

CVE Published

May 12, 2026 - 13:25 nvd

HIGH 8.2

DescriptionCVE.org

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

AnalysisAI

OS command injection in Dell PowerScale InsightIQ 6.0.0 through 6.2.0 allows high-privileged local administrators to execute arbitrary system commands with elevated privileges, achieving container escape (scope change) on the storage cluster management platform. Dell published security advisory DSA-2026-208 addressing this vulnerability. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation at time of analysis.

Technical ContextAI

PowerScale InsightIQ is Dell's performance monitoring and analytics appliance for PowerScale (formerly Isilon) storage clusters, typically deployed as a virtual machine or containerized service with access to cluster management APIs. This vulnerability stems from improper neutralization of special elements in OS command construction (CWE-78), a class of injection flaws where user-controlled input is passed unsanitized to system shell interpreters. The affected CPE (cpe:2.3:a:dell:powerscale_insightiq) encompasses versions 6.0.0 through 6.2.0, representing approximately two years of product releases. The CVSS vector indicates a changed scope (S:C), suggesting the attacker can break out of the immediate application context-likely escaping containerization or VM boundaries to affect the underlying hypervisor or adjacent storage cluster nodes.

RemediationAI

Dell has published security update DSA-2026-208 addressing this vulnerability-upgrade PowerScale InsightIQ to the patched version specified in the advisory at https://www.dell.com/support/kbdoc/en-us/000463695/dsa-2026-208-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities (exact patched version number not independently confirmed from provided data; consult Dell advisory for specific release). If immediate patching is not feasible, implement compensating controls: restrict InsightIQ administrative access to jump hosts or privileged access workstations with session recording and command logging enabled; enforce multi-factor authentication for all InsightIQ administrator accounts; implement network segmentation isolating InsightIQ management interfaces from general administrative networks; audit all privileged user activity with SIEM correlation rules flagging unusual command patterns. Note that restricting administrative access may impact legitimate monitoring workflows and should be coordinated with storage operations teams. These mitigations reduce attack surface but do not eliminate the underlying vulnerability-patching remains the definitive remediation.