EUVD-2026-61049
GHSA-8vwp-cgv5-3q4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach array SMB/CIFS service over network
-
DeliverySend specially crafted SMB packet
-
ExploitTrigger out-of-bounds write in SDNAS
-
ExecutionCorrupt controller memory
-
ImpactCrash node (persistent under auto-restart) or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the PowerStore array's SMB/CIFS (SDNAS) service, which must be enabled and serving file shares - the crafted SMB packet is the trigger and no authentication or user interaction is needed (PR:N/UI:N confirmed by CVSS vector). The persistent nature of the DoS specifically requires that automatic restart is enabled on the array (per the description). Practical limiting factors: SMB/CIFS is typically exposed only on internal file-serving/management networks rather than the public internet, so the attacker must already be able to route to TCP/445 on the array; the RCE outcome (as opposed to a crash) is explicitly described as requiring a more sophisticated attacker able to weaponize the memory corruption, so it is not a turnkey capability. |
| Impact | This is a genuine high-priority issue rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) aligns cleanly with the description: unauthenticated, network-reachable, low complexity, single-packet trigger, with full confidentiality/integrity/availability impact on the storage node. All internal signals are consistent - there is no contradiction between the vector and the narrative. What tempers the risk is exposure context: SMB/CIFS (typically TCP/445) on a storage array is normally reachable only from an internal management or file-serving network, not the public internet, so realistic exploitation depends on the attacker already being on a network segment that can reach the array. No EPSS score was provided, the CVE is not listed in CISA KEV, and no POC is referenced, so there is no evidence of active exploitation. The DoS path is highly reliable (crash-on-packet, persistent under auto-restart); the RCE path is described as requiring a 'more sophisticated attacker,' i.e. weaponizing memory corruption into control flow, which is a materially higher bar than the crash. |
| Exploit ScenarioDerived | An attacker with network reachability to a PowerStore array's SMB service sends a single specially crafted SMB/CIFS packet that triggers the out-of-bounds write, crashing the SDNAS node and - because auto-restart is enabled - re-crashing it on each retry to sustain a denial of service against file storage. A more sophisticated attacker crafts the packet to control the memory overwrite and achieve remote code execution on the storage controller. No public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
RemediationAI
Vendor-released patch: PowerStore OS version 5.0.0.2-2761110 or later; upgrade all affected PowerStore T-series arrays to this build per Dell advisory DSA-2026-330 (https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities). Until the upgrade is applied, reduce exposure of the SMB/CIFS service by restricting network access to the array's file-serving and management interfaces to trusted hosts only - block or firewall TCP/445 (and related SMB ports) from any untrusted segment, which prevents the crafted packet from reaching the SDNAS handler at the cost of legitimate SMB clients on blocked segments losing file access. If SMB/CIFS file services are not in use on a given array, disabling the NAS/SMB service removes the attack surface entirely, though this obviously breaks Windows file sharing. Because the crash is persistent under automatic restart, consider whether auto-restart behavior should be reviewed as part of incident handling, but note this only affects DoS recovery and does not address the underlying RCE risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the SMB/CIFS protocol handler of PowerStore's Scale-out NAS (SDNAS) component, the software layer that lets PowerStore T arrays serve Windows file shares. The root cause is CWE-787 (Out-of-bounds Write): attacker-controlled data in a crafted SMB packet is written past the bounds of an allocated buffer during protocol parsing, corrupting adjacent memory. Out-of-bounds writes of this kind are classic memory-corruption bugs that can be steered from a simple crash (writing into an unmapped/critical region) up to controlled overwrite of function pointers or heap metadata, which is what enables the escalation from DoS to RCE. The affected surface is the entire PowerStore T-series line per the CPE data - models 500T, 1000T, 1200T, 3000T, 3200Q, 3200T, 5000T, 5200Q, 5200T, 7000T, 9000T and 9200T - all sharing the same SDNAS code path.
Know when Powerstore 500T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single-packet SMB trigger over the network (AV:N/AC:L/PR:N/UI:N); memory corruption yields DoS plus potential RCE on the controller, giving full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and Remote execution. This is a Critical vulnerability as a remote user could send a specially crafted SMB packet and cause a crash, that is persistent in case automatic restarts are enabled. Additionally, a more sophisticated attacker could use the same vulnerability for Remote Code execution.
Executive ViewAI
Dell PowerStore T-series storage arrays running SDNAS software contain a critical remote code execution and denial-of-service vulnerability (CVE-2026-67271, CVSS 9.8) accessible to any network attacker without authentication. A single malformed SMB packet can crash storage nodes, and configured auto-restart functionality converts temporary failures into persistent service outages; more sophisticated attackers can achieve arbitrary code execution on the storage controller. This directly threatens data availability and confidentiality for any organization relying on these arrays and requires immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Powerstore 500T
View allUnauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administ
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Exploit-DB