Dell CSI PowerMax CVE-2026-63691

Exploitation requires the attacker to have adjacent network access (AV:A) to the Dell CSI Driver for PowerMax csireverseproxy - typically meaning a presence on the same Kubernetes cluster pod/service network or an adjacent network segment where the proxy is reachable; it is not exploitable from the open internet by default. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any adjacent actor who can reach the proxy can attempt it. The vulnerability is present in Dell Container Storage Modules versions prior to 1.18.0; the primary limiting factors are the network-adjacency requirement and the limited impact (low confidentiality, low availability, no integrity), which constrain realistic damage even on unpatched, default deployments running the PowerMax reverse proxy.

This is a moderate-severity (CVSS 6.1) missing-authorization flaw (CWE-862) in the csireverseproxy component of Dell's CSI Driver for PowerMax. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L indicates an adjacent-network, low-complexity, unauthenticated attack with a scope change but only low confidentiality and low availability impact and no integrity impact - so the ceiling on damage is limited. The AV:A (adjacent) requirement is the single most important risk-limiting signal: the attacker must already have a foothold on the same logical network segment (e.g., the Kubernetes pod/service network or an adjacent broadcast domain), which meaningfully narrows exposure versus a fully remote (AV:N) issue. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization; no SSVC decision data was supplied either. Net assessment: this is a genuine but not emergency-grade issue - patch on a normal prioritized cycle rather than as a drop-everything item, because the adjacency requirement plus limited (low/none) impact metrics keep real-world risk modest despite the unauthenticated nature. No conflicting signals were observed between the vector and description (both agree on adjacent, unauthenticated access).

An attacker who has already gained a position on the adjacent network (for example, a compromised pod or a host on the same Kubernetes cluster/service network as the PowerMax csireverseproxy) sends requests to the proxy without providing valid authorization. Because authorization checks are missing, the proxy grants access it should not, allowing the attacker to reach protected storage-management functionality or data. No public exploit code was identified at time of analysis, so exploitation would require an attacker to craft their own requests against the proxy.