Dell PowerFlex Manager
CVE-2026-35162
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low-privileged remote authentication required to reach the access control flaw; impact is availability-only with no confidentiality or integrity exposure.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
AnalysisAI
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial of service condition against the management platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable with minimal complexity once credentials are obtained, and is limited in scope to availability degradation (A:L). No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Dell PowerFlex Manager is the centralized orchestration and lifecycle management layer for Dell's PowerFlex software-defined infrastructure platform (formerly ScaleIO/VxFlex OS), managing compute, storage, and networking resources. CWE-284 (Improper Access Control) indicates the root cause is insufficient enforcement of authorization boundaries - the application does not correctly verify whether a low-privileged principal is permitted to invoke certain operations, allowing actions that should be restricted to higher-privilege roles. The CPE string cpe:2.3:a:dell:powerflex:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the vendor has not scoped the affected range to specific versions in the NVD submission. Notably, the intelligence tags include 'Authentication Bypass,' which conflicts with the CVSS PR:L metric; this may reference a separate co-bundled CVE within the same multi-vulnerability advisory DSA-2026-066 rather than this specific finding.
RemediationAI
Apply the security update issued by Dell per advisory DSA-2026-066 at https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities. No specific patched version number was included in the available intelligence data - consult the advisory directly to identify the exact target release for your deployment. As a compensating control prior to patching, restrict network access to the PowerFlex Manager management interface to authorized administrator subnets via firewall or network ACL, reducing the pool of principals with low-privileged access who could trigger the condition. Additionally, audit and minimize the number of accounts holding any access to PowerFlex Manager to reduce attack surface. Note that network segmentation does not eliminate the vulnerability but reduces exploitability by constraining reachability.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today