Dell Unisphere for PowerMax CVE-2026-54470

Exploitation requires a valid low-privileged authenticated account on the Unisphere for PowerMax management interface, as confirmed by PR:L in the CVSS vector - unauthenticated remote attackers cannot exploit this vulnerability. The attacker must identify a specific XML-processing endpoint within the Unisphere web application and submit a payload that bypasses any input validation in place; the High Attack Complexity (AC:H) metric indicates that additional conditions must be satisfied, though their exact nature is not detailed in available data - likely involving specific endpoint identification, payload construction, or parser context. Exploitation is strictly limited to confidentiality impact (C:H): file contents or server-side request responses can be read, but integrity and availability are unaffected (I:N/A:N). The unchanged scope (S:U) means impact is contained within the Unisphere application boundary and does not directly propagate to other systems. The tags include 'Authentication Bypass', which may indicate the XXE can be used to read credentials enabling subsequent privilege escalation, but authentication bypass as a direct exploitation path is not confirmed from the CVSS vector alone.

The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the meaningful constraints on exploitation: High Attack Complexity (AC:H) and Low Privileges Required (PR:L) substantially reduce real-world exploitability compared to the High confidentiality impact (C:H) in isolation. An attacker must hold a valid low-privileged account and must satisfy unspecified complexity prerequisites - likely tied to identifying the specific vulnerable endpoint, constructing an effective payload, or navigating request validation - before gaining file read capability. No EPSS data was provided in the available intelligence, preventing probabilistic exploitation likelihood assessment. No active exploitation is confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, consistent with the relatively narrow audience of Unisphere administrators. Practically, the High confidentiality impact is the dominant risk signal: in enterprise storage environments, exposed configuration files, credentials, or API keys from the Unisphere server could enable lateral movement to the underlying PowerMax arrays or adjacent infrastructure. The risk is real but operationally gated - it requires an insider, compromised credential, or prior foothold, not unauthenticated external attack.

An attacker with a low-privileged Unisphere for PowerMax account - whether through credential theft, insider access, or a previously compromised service account - submits a crafted XML request to a vulnerable management API endpoint with an embedded external entity declaration referencing a local file path such as a credentials store or configuration file. The Unisphere XML parser resolves the entity server-side and returns the file contents in the API response, exposing sensitive data the attacker can use for further access. No public proof-of-concept has been identified at time of analysis, but XXE exploitation is a well-documented and widely understood technique with numerous published tools and templates.