Dell PowerStore CVE-2026-58569

Exploitation requires an authenticated session on the PowerStore appliance with at least limited (low-privilege) OS-level or management-shell access - confirmed by CVSS PR:L. The attacker must be able to write to a path or location from which a root-privileged process loads code or configuration, which is the defining characteristic of CWE-829. The local attack vector (AV:L) means network-only access is insufficient; direct OS shell access or equivalent local execution capability is required. Factors limiting exploitation: (1) PowerStore management interfaces are typically restricted to dedicated administrative VLANs, raising the bar for initial access; (2) valid credentials for a local account are a hard prerequisite; (3) exploitation cannot be triggered remotely without first achieving local authentication. There is no evidence this vulnerability is exploitable with zero prior access or over unauthenticated network connections.

The CVSS 8.8 score with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a high-severity local privilege escalation. The local attack vector (AV:L) limits network-based opportunistic exploitation - an attacker must first achieve authenticated access to the appliance's OS shell or management interface, which is a non-trivial prerequisite for enterprise storage hardware typically protected by network segmentation and strict access controls. Low attack complexity (AC:L) and no user interaction (UI:N) mean that once local access is achieved, exploitation is straightforward. The Scope:Changed metric and C:H/I:H/A:H triple-high impact indicate full system compromise - root access on a storage controller is catastrophic, as it exposes all attached data, enables tampering with storage fabric configurations, and could affect availability of attached workloads. EPSS data is not provided; however, given the local-only attack vector, opportunistic mass exploitation is unlikely. The primary threat model is an insider threat, a compromised service account, or lateral movement from a previously breached system in the same management network segment.

An attacker who has compromised a low-privilege service account or management user account on a Dell PowerStore appliance - through credential theft, phishing, or lateral movement from another system in the management network - places a malicious script or library in a location accessible to a root-running daemon or scheduled task that loads code from an untrusted path. When the privileged process next executes, it includes the attacker-supplied code and runs it as root, granting the attacker full control of the storage operating system and access to all attached data. No public exploit code has been identified, but the low complexity rating suggests the attack is mechanically straightforward once local access is established.