Dell PowerStore CVE-2026-58567

Exploitation requires an authenticated local session on the Dell PowerStore appliance with at least limited user privileges, confirmed by CVSS PR:L and AV:L. The attacker must be able to supply input to the vulnerable OS command execution path, most likely through the appliance's management CLI or administrative interface accessible to limited-privilege accounts. Remote unauthenticated exploitation is not possible given the local attack vector. No non-default configuration is indicated as a prerequisite - any limited-privilege local account appears sufficient. Exploitation is bounded by the requirement for prior local credential access, which limits the attacker population to insiders, compromised credential holders, or attackers who have already established a foothold in the data center management plane.

The 8.8 CVSS score reflects a structurally serious vulnerability: low complexity, low initial privileges, no user interaction required, and full C/I/A impact with scope change. However, the local attack vector (AV:L) substantially limits real-world risk compared to a network-exploitable flaw - an attacker must already hold a local authenticated session with at least limited privileges (PR:L), which rules out remote unauthenticated exploitation. No EPSS score was provided in the available intelligence, and no CISA KEV listing or public POC was identified, making exploitation status unknown rather than confirmed. The primary realistic risk scenarios are insider threat, credential compromise followed by local access, or lateral movement from within the data center management network. The scope change to root means that once exploitation succeeds, the entire appliance and its stored data are fully under attacker control, warranting prioritized patching especially in multi-tenant or shared-access storage environments.

An attacker who has obtained a low-privilege local account on a Dell PowerStore appliance - through credential theft, insider access, or lateral movement from a compromised data center host - supplies crafted input containing shell metacharacters to a management command or configuration interface. The unsanitized input is passed to an OS-level execution function, injecting arbitrary commands that run as root. The attacker achieves full appliance control, enabling exfiltration of all stored data, disruption of storage services, or further lateral movement. No public POC has been identified at time of analysis.