PowerFlex Manager
CVE-2026-40641
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AV:N for network-accessible management interface; AC:H because exploiting broken crypto requires MitM network positioning; PR:N as the cryptographic channel weakness is pre-authentication; C:L/I:L reflect partial disclosure and tampering without full system compromise; A:N as no availability impact is described.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerFlex Manager, version(s) 4.6.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
AnalysisAI
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure management communications to potential interception and modification. Remote unauthenticated attackers who achieve the requisite network positioning - consistent with the CVSS AC:H rating - could exploit weak or deprecated cryptographic primitives to partially disclose sensitive management data (C:L) or tamper with communications in transit (I:L). Dell has published advisory DSA-2026-066 under the multi-CVE release DSA-2026-066; no public exploit code and no active exploitation (CISA KEV absent) have been identified at time of analysis.
Technical ContextAI
CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) indicates that Dell PowerFlex Manager 4.6.0.1 relies on one or more cryptographic primitives that are known to be weak, deprecated, or insufficiently secure - common examples include RC4, DES/3DES, MD5/SHA-1 for integrity, or short RSA/DSA key sizes. PowerFlex Manager is Dell's software-defined infrastructure management platform for PowerFlex (formerly VxFlex/ScaleIO) hyper-converged storage environments. The CPE cpe:2.3:a:dell:powerflex:*:*:*:*:*:*:*:* covers the PowerFlex software suite. The CVSS vector AV:N confirms the vulnerable component is reachable over the network, consistent with a management API or communication channel using weak TLS cipher suites, deprecated protocol versions, or flawed certificate validation. The root cause is not a logic flaw but a dependency on cryptographic constructs that can be broken through offline analysis or active protocol manipulation by an adversary with network access.
RemediationAI
Patch available per Dell vendor advisory DSA-2026-066 at https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities; the exact patched version number is not specified in the available intelligence and should be confirmed directly from the advisory before deployment. As an interim compensating control, organizations should restrict network access to the PowerFlex Manager management interface to a dedicated, isolated management VLAN accessible only from authorized administrator workstations - this directly addresses the AC:H network positioning prerequisite and eliminates practical MitM exposure. Additionally, auditing TLS configurations on the management plane and disabling known-weak cipher suites (RC4, 3DES, export-grade) at the network boundary or load balancer layer can reduce exploitability while the patch is staged. Note that cipher-suite restriction at the network layer may not fully mitigate the vulnerability if the broken algorithm is used internally rather than in the TLS handshake itself.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypas
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today