Dell Unisphere CVE-2026-54469

Exploitation requires network access to the Dell Unisphere for PowerMax management interface plus a valid low-privileged account (CVSS PR:L - this is NOT unauthenticated). The concrete trigger is submission of attacker-controlled serialized data to a Unisphere endpoint that deserializes untrusted input (CWE-502); no specific non-default feature toggle is named in the description, so the vulnerable deserialization path appears reachable in the standard product configuration of versions 10.3.0.5 and prior. Limiting factors that reduce realistic risk: the attacker must already possess credentials (any privilege level suffices), and the management interface must be network-reachable from the attacker - deployments that confine Unisphere to an isolated management network substantially raise the bar. No user interaction is needed (UI:N) and attack complexity is low (AC:L).

Signals are largely consistent and point to a genuine priority. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:L/UI:N and C:H/I:H/A:H, meaning network-reachable, low-complexity, requires only low privileges, no user interaction, and yields full compromise. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation or mass automation yet, and no public PoC was identified - this tempers immediate urgency relative to a KEV-listed bug. The one meaningful nuance is the privilege prerequisite: exploitation is not fully unauthenticated (PR:L), so realistic risk depends on how broadly low-privileged Unisphere accounts are provisioned and whether the management interface is exposed beyond a trusted admin network. Deserialization-to-root is historically a reliable, weaponizable bug class, so despite the absence of a public exploit today this should be treated as a near-term patch priority rather than a theoretical high-CVSS finding.

An attacker who has obtained a low-privileged Unisphere for PowerMax account (via phishing, credential reuse, or an insider) sends a crafted serialized object to the management interface over the network. The unsafe deserialization instantiates a gadget chain that executes attacker-supplied OS commands as root, giving full control of the storage-management appliance and the arrays it administers. No user interaction is required and attack complexity is low; no public PoC has been identified, so exploitation currently requires the attacker to develop the gadget chain.