Dell PowerScale InsightIQ CVE-2026-35161

Exploitation requires network reachability to the Dell PowerScale InsightIQ authentication interface on a vulnerable version (5.2.0 through 6.3.0) and that the account lockout mechanism be active (its default state per CWE-645 'overly restrictive' design). No credentials, user interaction, or special non-default configuration are required (PR:N/UI:N). The practical limiting factors are: impact is availability-only (locked-out accounts, not code execution or data exposure), lockouts are typically temporary and recoverable once they expire or are cleared by an administrator, and exposure depends on whether the InsightIQ management interface is reachable from untrusted networks rather than restricted to a management segment.

This is a genuinely moderate, DoS-only issue - not a top priority despite the unauthenticated network vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the CWE-645 'Overly Restrictive Account Lockout Mechanism' weakness: an unauthenticated remote attacker can reach the login function with low complexity, but impact is confined to availability with no confidentiality or integrity loss and no scope change. There is no EPSS score, no CISA KEV listing, and no public exploit referenced in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only source is the Dell vendor advisory (DSA-2026-439); no independent corroboration or exploitation telemetry is provided. The signals are aligned rather than conflicting - a low-severity availability flaw with no exploitation evidence - which places it in routine patch-cycle territory rather than emergency remediation, though it may matter more in environments that depend on InsightIQ for continuous storage monitoring.

An unauthenticated attacker with network reachability to the InsightIQ web/management interface repeatedly submits failed authentication attempts for one or more valid usernames, tripping the overly aggressive account lockout policy and locking those accounts out. Legitimate administrators and monitoring users are then denied access until lockouts expire or are manually cleared. No public proof-of-concept is referenced, and the attack is low-complexity because it only requires reaching the login endpoint and abusing its lockout behavior.