PowerScale InsightIQ CVE-2026-35071

Requires authenticated access to PowerScale InsightIQ administrative interface with high-privilege credentials (storage administrator or equivalent role), as indicated by PR:H in CVSS vector. Attack must be executed from a context where the attacker has local access to the InsightIQ system itself (AV:L), meaning either direct console access, SSH session, or compromised management workstation with established administrative session to the appliance. Exploitation requires identifying specific administrative functions within InsightIQ that accept user-controlled input and pass it unsanitized to OS command execution routines-this might include report customization features, data export functions, integration configuration interfaces, or diagnostic tools accessible only to privileged users. The vulnerability cannot be exploited remotely without first compromising high-privilege credentials or the management network. Limiting factors include the need for existing elevated access (not a typical initial access vector) and local attack vector constraint (not exploitable across the internet), making this primarily a post-compromise privilege escalation or container escape mechanism rather than a perimeter threat.

Despite the CVSS base score of 8.2 (High), real-world exploitation risk is constrained by multiple factors. The attack vector is local (AV:L) requiring existing administrative access to the InsightIQ management interface, and privileges required are high (PR:H), meaning the attacker must already control a highly privileged account-typically a storage administrator or equivalent. This is not a remote unauthenticated threat; it represents a privilege escalation or lateral movement opportunity within compromised infrastructure. The changed scope rating elevates severity because command execution likely breaks containment boundaries, potentially affecting the broader storage cluster beyond just the monitoring appliance. No CISA KEV listing exists, and EPSS score is unavailable, suggesting this is not being actively exploited at scale in the wild. Primary risk exists in environments where InsightIQ administrator credentials are shared, poorly audited, or where insider threat models apply. Organizations should prioritize based on whether InsightIQ management access is already segregated and monitored-if strong privileged access controls are in place, this becomes a defense-in-depth concern rather than an immediate crisis.

A storage administrator's workstation is compromised via phishing or watering hole attack, providing the attacker access to cached PowerScale InsightIQ credentials with high privileges. The attacker authenticates to the InsightIQ web interface or SSH service, navigates to a vulnerable administrative function that accepts user input (such as report generation, custom query execution, or configuration import), and injects shell metacharacters (e.g., semicolons, backticks, or pipe symbols) to append arbitrary OS commands. Because the application fails to sanitize this input before passing it to system shell calls, the injected commands execute with the privileges of the InsightIQ service, breaking out of application sandboxing (scope change) to access the underlying VM or container host, potentially pivoting to the broader storage cluster infrastructure.