Dell PowerScale OneFS CVE-2026-49501

Exploitation requires two concrete prerequisites: (1) local access to the affected Dell PowerScale OneFS system and (2) a high-privilege account (confirmed by PR:H in the CVSS vector), meaning the attacker must already possess administrative-level credentials or equivalent standing on the cluster node. The attack complexity is low (AC:L) and requires no user interaction (UI:N), indicating the privilege escalation path is mechanically straightforward once prerequisites are met. Factors that limit exploitation: purely remote, unauthenticated threat actors cannot exploit this flaw; the vulnerability is scoped exclusively to versions 9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2; no special non-default feature or protocol configuration beyond the vulnerable version is described as a trigger. The practical threat is post-compromise privilege escalation or insider abuse - not opportunistic internet-facing exploitation.

The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H encodes a vulnerability that is difficult to exploit remotely but devastating upon exploitation: an attacker must already hold local system access and high-privilege credentials, but once those conditions are met, attack complexity is low and no user interaction is needed, yielding full compromise. The 6.7 base score accurately reflects the significant prerequisite barrier. EPSS exploitation probability data is absent from the available intelligence, and neither CISA KEV listing nor publicly available proof-of-concept code has been identified - both signals reduce urgency relative to a KEV-listed or PoC-backed flaw. The primary real-world threat model is insider threat or lateral movement following the compromise of a high-privilege account, not opportunistic remote exploitation. For organizations using OneFS as central data repositories - where confidentiality and integrity of stored data are paramount - the C:H/I:H/A:H impact components make this a genuine remediation priority despite the moderate score.

A high-privileged OneFS administrator account - whether legitimately held by a malicious insider or obtained through credential theft targeting backup service accounts or cluster management interfaces - leverages the improper privilege management flaw to escalate to root or equivalent system-level privileges on a cluster node. With root access, the attacker can read all stored files across the cluster, disable auditing to cover tracks, modify file system access controls, or introduce persistent backdoor accounts into the cluster configuration. No public proof-of-concept code has been identified, so exploitation likely requires specific knowledge of the privilege management weakness within the OneFS internals.