EUVD-2026-42874
GHSA-pvj5-9xhr-xjvg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N), no exploit hurdles described (AC:L), requires a valid low-privileged account (PR:L), no user interaction (UI:N); deserialization yields root command execution, so C/I/A all High.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
Remote command execution in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged authenticated user to run arbitrary OS commands with root privileges by abusing unsafe deserialization of untrusted data (CWE-502). Because the CVSS vector is AV:N/AC:L/PR:L, any account with minimal access on the management interface can escalate to full root control of the storage-management appliance. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the low attack complexity and full CIA impact make it a high-priority patch for storage administrators.
Technical ContextAI
Dell Unisphere for PowerMax is the web-based management console for Dell PowerMax enterprise storage arrays (also delivered as a virtual appliance), used to provision, monitor, and administer high-end block/file storage. The root cause is CWE-502 Deserialization of Untrusted Data: the application reconstructs objects from attacker-influenced serialized input without validating type or content, so a crafted payload can instantiate gadget chains that reach command execution primitives. Because the management stack runs with elevated (root) service privileges, successful deserialization of a malicious object results in OS command execution in that root context rather than being confined to the application user. The Dell advisory DSA-2026-272 groups this with related fixes across PowerMaxOS, PowerMax eEM, Unisphere 360, and Solutions Enabler, indicating shared management components.
RemediationAI
Patch available per vendor advisory: apply the fixed release referenced in Dell DSA-2026-272 (https://www.dell.com/support/kbdoc/en-us/000483543/dsa-2026-272) - upgrade Unisphere for PowerMax to a version later than 10.3.0.5; the input does not state an exact fixed build, so obtain the precise target version from that advisory before scheduling the upgrade. Until patched, reduce exposure by restricting network reachability of the Unisphere management interface to a dedicated administrative/management VLAN or jump host and blocking it from general user and internet-facing networks, which limits the AV:N vector at the cost of requiring admins to connect via approved paths. Additionally, minimize the number of low-privileged Unisphere accounts and audit/rotate existing ones, since PR:L exploitation depends on an attacker holding some valid credential; note this does not eliminate risk from a compromised legitimate operator account. Monitor management-plane logs for anomalous requests to the affected endpoints as a detective control.
More in Unisphere For Powermax
View allDell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S
Dell Unisphere for PowerMax 10.2 lacks proper authorization checks, allowing authenticated remote attackers to bypass ac
Dell Unisphere for PowerMax 10.2 contains a path traversal vulnerability that allows authenticated remote attackers to o
Dell Unisphere for PowerMax versions 10.2 suffer from a path traversal vulnerability (CWE-73) that allows authenticated
Dell Unisphere for PowerMax 10.2 contains a relative path traversal flaw that allows authenticated remote attackers to m
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. Rated high severity (CVSS
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. Rated high severity
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVS
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual A
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to rem
Dell Unisphere for PowerMax 10.2 contains a file path control vulnerability that allows authenticated remote attackers t
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today