Dell Container Storage Modules CVE-2026-40711

Exploitation requires the attacker to already hold high privileges (CVSS PR:H) - a trusted storage/cluster administrator role or an equivalently privileged, compromised service account able to interact with the CSM CSI controllers (csi-powerstore, csi-unity, csi-powerflex, or csi-powermax at v2.16.0). The attack is remote/network-reachable (AV:N) but rated high complexity (AC:H), meaning success depends on additional non-trivial conditions to get attacker input into the vulnerable OS-command path rather than a single trivial request. No user interaction is required (UI:N). The key limiting factors are therefore the high-privilege prerequisite and the high complexity, which together restrict realistic exploitation to actors who have already gained significant foothold in a cluster running the affected CSM 2.16.0 drivers; it is not exploitable by an unauthenticated or low-privileged remote attacker. The exact field/feature carrying the unsanitized input is not specified in the available data and should be confirmed against Dell DSA-2026-259.

The signals are mixed and point to a high-impact but high-barrier issue rather than a mass-exploitation threat. CVSS 3.1 is 8.0 with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H: the impact triad is maximal and scope is changed, but exploitation requires high privileges (PR:H) and high attack complexity (AC:H), which substantially constrains who can exploit it and under what conditions. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. It is not in CISA KEV and no POC is referenced, so there is no evidence of active or imminent exploitation. The PR:H requirement means an attacker must already hold a high-privileged role (effectively a trusted storage/cluster administrator or a compromised service account with that level of access), which makes this primarily a privilege-escalation/lateral-movement concern in an already-partly-compromised environment rather than a perimeter-breach risk. Net: real and worth patching on a normal-to-elevated cadence for Dell CSM users, but not an emergency drop-everything item absent EPSS/KEV escalation.

An attacker who has already obtained high-privileged access to the cluster's storage-management plane (for example, a compromised storage-admin service account token or an insider with CSM controller permissions) submits a crafted request containing shell metacharacters in a field the CSI driver passes to an OS command. Because input is not neutralized (CWE-78), the injected command executes in the driver/controller context; the scope-change (S:C) means that execution can affect the underlying host or other cluster components beyond the driver. No public POC is referenced, and the high attack complexity (AC:H) implies the attacker must satisfy additional preconditions or timing to reliably trigger execution.