EUVD-2026-53930
GHSA-q6r6-m9h6-qhjm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IAPI endpoint over network
-
DeliverySend request with injected OS command
-
ExploitBreak out via unsanitized shell input
-
ExecutionExecute commands as root
-
PersistHarvest storage credentials, establish persistence
-
ImpactPivot to storage and vSphere infrastructure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the VSI appliance's IAPI component; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required beyond the IAPI service being deployed and reachable - this is remote unauthenticated exploitation against default deployments of Dell Virtual Storage Integrator prior to 10.11.1.0. The practical limiting factor is exposure of the IAPI component: VSI is a vSphere management-plane plugin typically installed on internal management networks, so an attacker must be able to route to that endpoint. Only versions below 10.11.1.0 are affected. |
| Impact | All available signals point to genuine high priority rather than an inflated CVSS. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and total confidentiality, integrity, and availability impact - the classic profile of a critical unauthenticated RCE. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here, and no SSVC decision record was supplied; however, an OS command injection yielding root with no preconditions is typically highly automatable with high technical impact if the IAPI endpoint is exposed. This is not in CISA KEV and no POC was referenced, so exploitation is not confirmed in the wild - the risk is driven by exploitability characteristics, not observed attacks. The main real-world limiter is exposure: VSI is a management-plane plugin usually deployed on internal/management networks, so environments that keep it off attacker-reachable networks face lower practical risk than the raw 9.8 suggests. |
| Exploit ScenarioDerived | An attacker with network access to the VSI appliance sends a crafted request to the exposed IAPI endpoint containing shell metacharacters in a parameter that is passed to an OS command, breaking out to execute their own commands as root without any credentials or user interaction. From that root shell they establish persistence, harvest stored storage-array credentials, and pivot into the managed storage and virtualization infrastructure. No public exploit was identified at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.
RemediationAI
Vendor-released patch: upgrade Dell Virtual Storage Integrator for VMware vSphere Client to version 10.11.1.0 or later, which is the fixed release per Dell advisory DSA-2026-335 (https://www.dell.com/support/kbdoc/en-us/000496035/dsa-2026-335-security-update-for-dell-virtual-storage-integrator-for-vmware-vsphere-client-multiple-vulnerabilities); Dell explicitly recommends upgrading at the earliest opportunity. Until the upgrade is applied, restrict network reachability of the VSI appliance and its IAPI component to a hardened management VLAN or jump host and block access from user and untrusted networks, since the exploit is network-based and unauthenticated - the trade-off is that legitimate remote administration must then route through the restricted path. Place the plugin behind firewall/ACL controls that permit only known vSphere management hosts to reach it, and monitor IAPI logs for anomalous command-injection patterns; note these are compensating controls only and do not remove the vulnerable code, so patching remains mandatory.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
VSI is a Dell plugin that integrates Dell storage arrays (Unity, PowerMax, PowerStore, VMAX-class) with the VMware vSphere Client, exposing management operations through its internal API layer (the IAPI component). CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that attacker-controlled input reaching IAPI is passed to a shell or system-call interface without adequate sanitization, so shell metacharacters or command separators can break out of the intended command and execute arbitrary commands. The single wildcard CPE (cpe:2.3:a:dell:virtual_storage_integrator_for_vmware_vsphere_client:*) shows Dell has not enumerated individual affected builds in the CPE data, but the description bounds the affected range as everything below 10.11.1.0. Because IAPI runs with root privileges on the underlying appliance OS, a successful injection inherits full system control rather than a constrained service account.
Know when Virtual Storage Integrator For Vmware Vsphere Client gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable IAPI command injection with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding root gives full C:H/I:H/A:H; scope unchanged as the OS is the vulnerable system.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
Articles & Coverage 1
Executive ViewAI
Dell Virtual Storage Integrator (VSI) versions prior to 10.11.1.0 contain a critical unauthenticated remote code execution vulnerability allowing attackers to execute commands as root on the appliance, compromising the entire storage infrastructure it manages. This vulnerability is exploitable over the network without authentication or user interaction, creating an immediate threat to organizations relying on VSI for storage management. With no vendor-released patch identified at time of analysis, urgent compensating controls are required to prevent compromise of business-critical storage systems.
Implement strict network segmentation and firewall rules to restrict access to VSI appliances from untrusted networks; disable or restrict remote access to management interfaces; enable comprehensive logging of all access attempts and administrative actions on VSI systems; deploy network-based intrusion detection/prevention systems (IDS/IPS) configured to monitor for exploitation patterns targeting the IAPI component; consider operational workarounds such as isolating VSI in air-gapped environments or restricting its scope to essential storage management functions only until patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB