EUVD-2026-42868
GHSA-cmv5-wf6c-fjcg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable SQLi needing only low-privilege auth (PR:L, AC:L); scope change (S:C) as injected query reaches data beyond the input component; confidentiality-dominant with minor integrity, no availability impact.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information exposure, and Unauthorized access.
AnalysisAI
SQL injection in Dell PowerFlex Manager prior to version 5.1.0.1 allows a remote, low-privileged authenticated attacker to inject crafted SQL commands through the management interface, resulting in information disclosure and unauthorized access to data beyond the attacker's authorized scope. Rated CVSS 8.5 with a scope-changed vector, the flaw is reported by Dell (DSA-2026-066) and carries confidentiality impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
PowerFlex Manager is Dell's centralized management console for the PowerFlex (formerly ScaleIO/VxFlex OS) software-defined storage and hyperconverged infrastructure platform, orchestrating provisioning, lifecycle, and monitoring of PowerFlex nodes. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a backend database query without adequate parameterization or sanitization, letting an attacker alter query logic. The CVSS scope-changed flag (S:C) indicates the injected query can reach data or authorization contexts outside the component that accepts the input - consistent with the 'Authentication Bypass' and 'Unauthorized access' framing in the tags and description.
RemediationAI
Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later, which Dell released as the fix per advisory DSA-2026-066 (https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities). Until the upgrade is applied, restrict network reachability of the PowerFlex Manager web/management interface to a dedicated management network or jump host and block it from general user and internet-facing segments, since the attack vector is network-based; this reduces exposure but does not protect against an already-authorized low-privilege insider. Tighten and audit low-privilege account provisioning and rotate credentials, because exploitation requires only PR:L access - the trade-off is added operational overhead for account management. If available, place a WAF or database-activity-monitoring control in front of the interface to flag anomalous SQL patterns, accepting that signature-based filtering may miss tailored payloads and can generate false positives.
More in Powerflex Manager
View allDell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
Root-level OS command execution in Dell PowerFlex Manager (versions prior to 5.1.0.1) lets a remote, high-privileged att
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link th
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a
SQL injection in Dell PowerFlex Manager before 5.1.0.1 lets a low-privileged, remotely authenticated user inject crafted
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows u
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. Rated mediu
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker o
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-p
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentia
Same weakness CWE-89 – SQL Injection
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today