Unisphere for PowerMax CVE-2026-54468

Exploitation requires a valid low-privileged account on the Dell Unisphere for PowerMax management interface (PR:L per CVSS vector) and remote network access to the management service (AV:N). No user interaction is required (UI:N) and no special configuration beyond a functional Unisphere deployment is indicated. Exploitation is limited by the authentication requirement - unauthenticated attackers cannot exploit this flaw. Impact is read-only (C:H/I:N/A:N), meaning attackers can exfiltrate files but cannot directly modify or delete data through this vulnerability alone. Organizations that restrict Unisphere to isolated management networks further limit reachability.

The vendor-assigned CVSS 6.5 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable with low complexity, requiring only low-privileged authentication, and producing high confidentiality impact. In real-world terms, this is a meaningful risk for organizations whose Unisphere management interface is exposed beyond a strict management VLAN or jump-host boundary, since any valid low-privileged account can be leveraged to read sensitive files. No EPSS data was provided in the intelligence package; without it, exploitation probability cannot be quantified. No KEV listing means active exploitation has not been confirmed by CISA, and no POC code is referenced, reducing immediate threat urgency. However, path traversal primitives in management interfaces are well-understood by attackers, and low attack complexity (AC:L) means automated scanning or rapid exploitation is plausible once credentials are available. The primary limiting factor is the PR:L requirement - without valid credentials, exploitation is blocked. Organizations enforcing least-privilege and MFA on management consoles face materially lower real-world risk than those with shared or default credentials.

An attacker with a valid low-privileged Unisphere account - obtained via credential stuffing, phishing, or insider access - sends an HTTP request to the management interface with a path parameter containing traversal sequences (e.g., '../../etc/passwd' or '../../opt/dell/config/credentials.xml'). The server fails to normalize or reject the traversal sequence and returns the contents of the targeted file. No public proof-of-concept is known, but the technique is trivially constructed by any attacker familiar with path traversal.