Dell PowerStore CVE-2026-67262

The attacker must control a host whose initiator identity (iSCSI IQN, Fibre Channel WWN, or NVMe NQN) is already registered in the PowerStore host mapping configuration - this is the primary limiting condition. Exploitation is not possible from arbitrary network positions or from hosts not enrolled in the array's host configuration. Once that mapped-host foothold is established, no additional storage-level credentials, administrative privileges, or special protocol configurations are required to access unauthorized LUNs; the authorization bypass occurs transparently at the data-plane. The high attack complexity (AC:H in the provided CVSS vector) reflects the prerequisite of first compromising or gaining access to a mapped host rather than any inherent cryptographic or race-condition difficulty in the exploit itself. Exploitation is bounded to hosts and initiators with an active SAN fabric connection; hosts on unrelated network segments with no storage mapping cannot exploit this vulnerability.

The CVSS 8.1 (High) rating with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable flaw with complete confidentiality, integrity, and availability impact, but the AC:H modifier is the critical qualifier: exploitation requires the attacker to already control a host that is mapped and connected to the array, making this far less opportunistic than a typical unauthenticated network flaw. The PR:N assignment in the provided vector warrants scrutiny - 'access to a mapped host' is a meaningful prerequisite that arguably elevates the practical privilege bar beyond PR:N, and security teams should not interpret PR:N as implying any internet-facing exposure without a prior foothold. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog, both signals that lower immediate urgency compared to confirmed-exploited flaws; however, even a mid-sized municipal IT team in olsztyn managing converged infrastructure on PowerStore should treat this as urgent, because a compromised application server already in the SAN fabric is precisely the lateral-movement pivot that converts a host compromise into a full storage breach. In shared SAN environments where a single PowerStore array serves multiple tenants or security domains, the blast radius of a successful exploit is exceptionally high - one compromised workload host can read or corrupt the storage of every other workload on the array.

An attacker who has compromised an application server legitimately mapped to the PowerStore array - for example via an OS-level exploit on a connected database host - sends iSCSI, FC, or NVMe-oF I/O requests targeting LUN IDs not assigned to that initiator. Because the per-initiator authorization check is missing, the array services these requests, granting the attacker raw block-level read access to a neighboring workload's LUN (e.g., another tenant's database volume) or write access sufficient to corrupt or overwrite it. No public exploit code is known at time of analysis.