What is the CVSS score of CVE-2026-40711?

CVE-2026-40711 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Dell Container Storage Modules are affected by CVE-2026-40711?

Dell Container Storage Modules 2.16.0 (affecting csi-powerstore, csi-unity, csi-powerflex, and csi-powermax drivers) contains a remote command injection vulnerability (CVSS 8.0) accessible to…. A patch is available.

How to fix or mitigate CVE-2026-40711?

Within 24 hours: Identify all deployments running CSM 2.16.0 across infrastructure; restrict administrative access to storage driver APIs; enable command-injection detection in container runtime or host-level security tools. Within 7 days: Implement network segmentation isolating storage management interfaces; enforce RBAC limiting driver access to least-privileged accounts; document current CSM versions and deployment topology. Within 30 days: Upgrade to patched version once vendor releases fix (monitor Dell security advisories); if upgrade timeline exceeds risk tolerance, consider temporary operational workarounds such as disabling non-essential drivers or moving critical storage workloads.

Dell Container Storage Modules CVE-2026-40711

EUVD-2026-39652 HIGH

OS Command Injection (CWE-78)

2026-06-26 dell

GHSA-6p63-373v-wp23

Command Injection Dell Container Storage Modules

8.0

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Remote-reachable but requires already-high cluster/storage privileges (PR:H) and non-trivial preconditions (AC:H); injected OS command yields full C/I/A impact with scope change beyond the driver (S:C).

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 14:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:20 vuln.today

DescriptionCVE.org

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

AnalysisAI

OS command injection in Dell Container Storage Modules (CSM) version 2.16.0 - spanning the csi-powerstore, csi-unity, csi-powerflex, and csi-powermax CSI drivers - lets a remote, high-privileged attacker inject and execute arbitrary operating-system commands (CWE-78). Successful exploitation yields full confidentiality, integrity, and availability impact with a scope change, meaning command execution can reach beyond the vulnerable component into the surrounding host or cluster. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 3.1 base score is 8.0 (High).

Technical ContextAI

Dell Container Storage Modules are the CSI (Container Storage Interface) drivers and sidecar components that integrate Dell enterprise storage arrays (PowerStore, Unity XT, PowerFlex, PowerMax) into Kubernetes/OpenShift platforms, handling volume provisioning, snapshots, replication, and array management. The flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the classic command-injection root cause: attacker-influenced input is passed into a shell or OS command interpreter without proper sanitization or escaping, so embedded metacharacters (e.g. ;, |, $(), backticks) are interpreted as additional commands. The single affected CPE is cpe:2.3:a:dell:container_storage_modules, and all four named drivers are pinned to release v2.16.0, indicating a shared code path or common library across the CSM suite rather than a single-driver bug.

RemediationAI

Patch available per vendor advisory: upgrade Dell Container Storage Modules above the affected 2.16.0 release per Dell DSA-2026-259 (https://www.dell.com/support/kbdoc/en-za/000478300/dsa-2026-259-security-update-for-dell-container-storage-modules-multiple-vulnerabilities); the input does not include a confirmed fixed version number, so consult the advisory for the exact patched release for each driver (csi-powerstore, csi-unity, csi-powerflex, csi-powermax) and bump the corresponding Helm chart/operator image tags. Because exploitation requires high privileges, the strongest compensating control until patching is to tighten who holds those privileges: restrict and audit Kubernetes RBAC so only essential service accounts and named administrators can interact with the CSM controllers and their CRDs (trade-off: may interrupt automation that relies on broad permissions), enforce namespace isolation and network policies limiting reach to the CSI controller pods, and enable audit logging on storage-management API calls to detect anomalous command-like input. Avoid exposing the cluster API/management plane to untrusted networks. These controls reduce the population of actors who can reach PR:H but do not remove the underlying injection flaw, so they are stopgaps, not substitutes for the upgrade.