Dell PowerFlex Manager
CVE-2026-49502
HIGH
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Adjacent management network reach (AV:A), no auth or interaction needed (PR:N/UI:N), low complexity, with high confidentiality and integrity impact but no availability effect per the description.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access.
AnalysisAI
Improper authentication in Dell PowerFlex Manager allows unauthenticated attackers with adjacent network access to bypass authentication controls, resulting in information disclosure, data tampering, and unauthorized access to managed storage infrastructure. The vulnerability carries a CVSS 8.1 rating reflecting high confidentiality and integrity impact, though no public exploit identified at time of analysis and EPSS scores it at 0.19% probability. SSVC scoring from CISA indicates no observed exploitation and partial technical impact.
Technical ContextAI
Dell PowerFlex Manager is the centralized management interface for Dell's PowerFlex software-defined storage platform, used to provision, monitor, and orchestrate hyperconverged and disaggregated storage clusters. The CPE identifier cpe:2.3:a:dell:powerflex confirms the affected product family. The root cause is classified as CWE-287 (Improper Authentication), meaning the management interface either fails to properly verify identity claims, accepts insufficient credentials, or allows authentication state to be manipulated. Because PowerFlex Manager typically resides on management VLANs alongside storage and compute nodes, the adjacent-network attack vector (AV:A) aligns with the deployment topology where the manager is reachable from within a storage fabric or management segment rather than across the public internet.
RemediationAI
Patch available per vendor advisory: consult Dell DSA-2026-066 at https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities for the exact fixed PowerFlex Manager build and apply the vendor-supplied update during a maintenance window. Until patching is complete, restrict the PowerFlex Manager management interface to a dedicated management VLAN reachable only from administrative jump hosts, enforce strict ACLs at the top-of-rack or firewall layer to block lateral traffic from tenant or workload VLANs, and monitor authentication logs for anomalous session establishment from unexpected source addresses. Because the attack vector is adjacent (AV:A), network segmentation is a high-value compensating control with the trade-off that legitimate administrative tooling on shared management networks may need ACL exceptions.
Missing authentication on a critical function in Dell PowerFlex Manager allows an adjacent-network attacker to invoke pr
Authentication bypass in Dell PowerFlex Manager allows an unauthenticated attacker with adjacent-network access to gain
SQL injection in Dell PowerFlex Manager allows a low-privileged attacker with adjacent-network access to inject SQL comm
Privilege escalation in Dell PowerFlex Manager allows a low-privileged attacker on an adjacent network segment to bypass
Information disclosure in Dell PowerFlex Manager versions prior to 4.8 stems from inclusion of functionality from an unt
Improper access control in Dell PowerFlex Manager allows a low-privileged remote attacker to trigger a denial-of-service
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial o
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insuf
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today