Dell Virtual Storage Integrator CVE-2026-54489

No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0. The attacker only needs network access to the VSI plug-in/vSphere Client interface; no credentials, user interaction, or non-default configuration is described. The practical limiting factors are network reachability of the VSI management interface (typically an internal vCenter management network rather than the public internet) and the presence of an active authenticated session whose credentials can be captured to make impersonation valuable.

The signals are largely consistent that this is a genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total. The main tempering signal is exploitation maturity: SSVC Exploitation is 'none', there is no KEV listing, no public POC is identified, and EPSS is only 0.39% (32nd percentile), indicating no widespread exploitation observed so far. The C:H/I:H/A:H rating is somewhat generous for what the description frames as an information-disclosure/session-hijack issue - the integrity and availability impact appear to be downstream consequences of full user impersonation rather than direct effects, so the practical impact hinges on what a hijacked administrator session can do within vSphere. Net: treat as high-priority patching due to unauthenticated network exploitability and administrative impersonation potential, while noting exploitation is currently theoretical rather than observed.

An attacker with network reachability to the VSI plug-in interface sends crafted requests to the vulnerable endpoint and retrieves active session credentials without any authentication or user interaction. Reusing a captured administrator session token, the attacker impersonates that administrator inside the vSphere Client and manages Dell storage and virtual infrastructure with full privileges. No public POC is identified at time of analysis, but CVSS AC:L and SSVC Automatable:yes indicate exploitation would be straightforward once the leak vector is known.