What is the CVSS score of CVE-2026-40633?

CVE-2026-40633 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Dell PowerScale OneFS are affected by CVE-2026-40633?

Dell PowerScale OneFS (versions 9.5.0.0-9.13.0.2) exposes sensitive secrets through application log files, allowing any authenticated local user to access data they should not reach.. A patch is available.

How to fix or mitigate CVE-2026-40633?

Within 24 hours, identify all Dell PowerScale OneFS systems in your environment and verify whether they run affected versions 9.5.0.0-9.10.1.7 or 9.11.0.0-9.13.0.2; notify your infrastructure and data security teams of the local access prerequisite and the log-based exposure. Within 7 days, restrict interactive shell access to PowerScale clusters to named administrators only, enable centralized logging of all local user access, and deploy monitoring and alerting on log file read operations. Within 30 days, review Dell's security advisory DSA-2026-261 regularly for patch availability and establish a staged testing and deployment plan for immediate application when a fix is released.

Dell PowerScale OneFS CVE-2026-40633

EUVD-2026-44607 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-15 dell

GHSA-gxv8-ggvr-3r24

Information Disclosure Dell Powerscale Onefs

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (dell) PRIMARY

HIGH

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local low-privileged access with no interaction reads logged secrets, so AV:L/PR:L/C:H; a pure log-disclosure flaw has no integrity or availability impact, unlike the vendor's I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 15, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

Jul 15, 2026 - 19:52 NVD

7.8 (HIGH) 5.5 (MEDIUM)

Patch available

Jul 15, 2026 - 12:02 EUVD

Analysis Generated

Jul 15, 2026 - 11:15 vuln.today

CVE Published

Jul 15, 2026 - 10:07 cve.org

HIGH 7.8

DescriptionNVD

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

AnalysisAI

Local information disclosure in Dell PowerScale OneFS (9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2) arises from sensitive data being written to log files, allowing a low-privileged local user to read secrets they should not access. Dell reported the issue (advisory DSA-2026-261) with no public exploit identified at time of analysis. Exploitation requires existing local, authenticated access to the cluster, limiting reach to insiders or attackers who have already established a foothold.

Technical ContextAI

OneFS is the operating system powering Dell's PowerScale (formerly Isilon) scale-out NAS clusters, providing a single distributed filesystem across multiple nodes for enterprise unstructured-data storage. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): application, service, or diagnostic logging paths record data such as credentials, tokens, keys, or other confidential material in cleartext to log files that are readable by lower-privileged accounts. The affected component is identified by CPE cpe:2.3:a:dell:powerscale_onefs, spanning the 9.5 through 9.13 release trains. Because log files often persist and may be aggregated or bundled into support diagnostics, the exposure window can outlast the moment the secret was logged.

RemediationAI

Upgrade OneFS to a Dell-remediated release as directed in advisory DSA-2026-261 (https://www.dell.com/support/kbdoc/en-us/000483600/dsa-2026-261-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities); the input does not include a single exact fix build, so treat this as Patch available per vendor advisory and consult the DSA-2026-261 version matrix for the precise fixed build corresponding to your 9.5-9.13 branch. Until patched, apply compensating controls: restrict and audit local and administrative accounts on the cluster so only trusted operators have shell/local access (reduces the pool of low-privileged users who can read logs, at the cost of tighter operational access); tighten permissions on and rotate access to OneFS log directories where feasible; and rotate any credentials, keys, or tokens that may already have been written to logs, since patching stops future logging but does not scrub secrets already recorded. Purge or securely archive existing log files and support-bundle exports that may contain the exposed data before they are shared with support.