EUVD-2026-69060
GHSA-4522-54pv-7j84
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege PowerStore account
-
DeliverySend crafted spoofed identity claim to management API
-
ExploitBypass privilege verification via CWE-290
-
ExecutionAchieve Administrator session
-
ImpactModify or destroy storage volumes and configurations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated session with at least low-privilege access to the Dell PowerStore management interface, confirmed by the CVSS PR:L metric. The attack is delivered over the network (AV:N) with no user interaction required (UI:N) and no special attack complexity (AC:L). The CWE-290 spoofing mechanism implies the attacker must craft a request that presents a falsified identity or privilege token - likely targeting the PowerStore Manager REST API or authentication middleware - that the management plane accepts without sufficient validation. Exploitation is strictly limited to actors who already possess a valid (even minimal) PowerStore account on the target system; unauthenticated external attackers cannot exploit this flaw without first obtaining credentials through a separate attack. The specific configuration setting or API endpoint susceptible to spoofing is not disclosed in available data. |
| Impact | The CVSS 8.8 High score is well-calibrated: AV:N/AC:L/PR:L/UI:N reflects a straightforward network-exploitable flaw requiring only a low-privilege account, and S:U/C:H/I:H/A:H captures the full impact of Administrator-level storage access. The PR:L prerequisite is the primary limiting factor - this is not exploitable by unauthenticated external actors, reducing mass-exploitation risk. No EPSS data was provided, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV and no POC is known, indicating no confirmed active exploitation at time of analysis. Real-world risk is highest in multi-tenant or shared storage environments where multiple users hold lower-tier roles (e.g., storage operators, backup admins) who could escalate to Administrator and gain the ability to delete volumes, disable snapshots, alter replication targets, or expose all stored data. Organizations with strict storage admin segregation and tightly controlled account provisioning face lower practical risk. |
| Exploit ScenarioDerived | An attacker with a low-privilege PowerStore account - such as a storage operator or backup role user - sends a crafted request to the PowerStore management API that presents a spoofed identity or role claim, causing the management layer to grant Administrator-level access without valid authorization. With Administrator control, the attacker can then delete volumes or snapshots, alter replication configurations, or access all data on the array. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.
RemediationAI
Apply the PowerStore OS security update referenced in Dell advisory DSA-2026-330 at https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities using the PowerStore Manager upgrade workflow; the exact patched version number was not included in the available input data and must be obtained directly from the advisory. As a compensating control pending patching, restrict access to the PowerStore management interface (PowerStore Manager UI and REST API) to only the minimum set of trusted administrator accounts using network firewall rules or management network segmentation - this reduces the population of accounts that could exploit the privilege escalation. Audit all existing non-Administrator PowerStore user accounts and revoke any unnecessary low-privilege accounts, as each represents a potential exploitation path. Note that network segmentation does not eliminate the vulnerability if insider threat actors hold valid accounts within the allowed management network.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-290 (Authentication Bypass by Spoofing) describes a class of flaws where a system incorrectly grants elevated trust based on a spoofed identity signal - commonly a manipulated token, header, session identifier, or role claim - without adequately verifying its authenticity. Dell PowerStore is a unified block, file, and object enterprise storage platform built on dedicated appliance hardware. The breadth of affected CPE strings (cpe:2.3:a:dell:powerstore_500t through powerstore_7000t) across both T-series and Q-series models strongly suggests the vulnerability resides in the shared PowerStore OS management layer rather than model-specific firmware. The network attack vector (AV:N) confirms the vulnerable component is reachable via the management interface, which in PowerStore deployments is typically the web-based PowerStore Manager UI or its backing REST API.
Know when Powerstore 500T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Management API is network-accessible, any low-privilege account suffices, and Administrator access yields full confidentiality, integrity, and availability impact on the storage system.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator.
Executive ViewAI
Dell PowerStore storage appliances are vulnerable to a privilege escalation attack that allows users with low-privileged management access to gain full Administrator control (CVE-2026-58575, CVSS 8.8). This directly compromises the confidentiality, integrity, and availability of enterprise storage systems for organizations where low-privilege accounts have access to PowerStore management interfaces. With no vendor-released patch identified at time of analysis, this poses an immediate operational risk requiring urgent access control remediation.
Restrict network access to PowerStore management interfaces using firewall rules and network segmentation; disable or restrict low-privileged accounts with management-plane access; implement enhanced audit logging and real-time alerting on administrative privilege escalations; consider air-gapping critical storage systems from general network access; monitor Dell security advisories for patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Exploit-DB