EUVD-2026-69036
GHSA-6rfj-pjgc-mv6h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege PowerStore account
-
DeliveryAccess management API over network
-
ExploitSend crafted request targeting admin-only operation
-
ExecutionAuthorization check incorrectly permits request
-
ImpactExecute privileged operation with full C/I/A impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid account on the Dell PowerStore management interface with at minimum low-privilege access - unauthenticated exploitation is not possible per the CVSS PR:L metric. The management interface must be network-reachable from the attacker's position (AV:N). No user interaction is required, and no non-default configuration is specified as a prerequisite. Exploitation is limited by the requirement for a legitimate (though low-privilege) credential; environments that restrict PowerStore management access to a small set of named administrators with no delegation to lower-privileged accounts reduce the exposure surface. The scope remains within the PowerStore system (S:U), so lateral movement beyond the appliance is not directly facilitated by this vulnerability alone. |
| Impact | CVSS 8.8 (High) with AV:N/AC:L/PR:L/UI:N presents a straightforward network-based privilege escalation requiring only a valid low-privilege account - no special conditions, no user interaction, no complexity. All three impact dimensions are rated High (C:H/I:H/A:H), consistent with admin-level control over a storage appliance including potential data access, configuration manipulation, and service disruption. No EPSS score was provided, and no KEV listing or POC code was identified at time of analysis, which tempers immediacy concerns. However, the low attack complexity means that once an authenticated foothold exists (e.g., a compromised service account or insider threat), exploitation is straightforward. For environments where storage management access is shared or delegated to non-admin personnel, this represents a realistic escalation path. The absence of KEV does not reduce the urgency of patching given the severity and attack simplicity. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege account on a Dell PowerStore appliance - through credential theft, insider access, or a compromised service account - sends a crafted API or management interface request targeting an operation restricted to administrators. Because the authorization check is implemented incorrectly, the system permits the request, allowing the attacker to perform actions such as modifying storage policies, accessing sensitive data, or disrupting storage availability. No public exploit code has been identified at time of analysis, but the low complexity of the attack vector means exploitation does not require specialized tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administrator-only management operations via the network, resulting in full confidentiality, integrity, and availability compromise of the storage system. The flaw stems from incorrect authorization checks (CWE-863), where the system fails to enforce proper privilege boundaries on API or management interface operations. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and high-impact CVSS 8.8 rating make this a credible threat in multi-tenant or shared-access storage environments.
RemediationAI
Apply the vendor-issued update referenced in Dell Security Advisory DSA-2026-330, available at https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities. The exact patched firmware or software version is not confirmed from the available data - consult the advisory directly for the specific update package and upgrade instructions. As a compensating control pending patching, restrict access to the PowerStore management interface to only trusted, named administrator accounts using network access controls or management network segmentation, thereby limiting the pool of low-privilege identities that could exploit this flaw. Audit existing low-privilege account assignments on PowerStore and revoke any accounts not requiring access. Note that network segmentation limits exposure but does not eliminate the vulnerability for users already on the management network.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell PowerStore is an enterprise all-flash storage platform spanning multiple appliance SKUs (500T through 7000T confirmed in CPE data). The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the system performs an authorization check but the check itself is flawed - it does not correctly validate whether a low-privilege principal is permitted to reach administrator-only operations. This differs from missing authorization (CWE-862) in that enforcement logic exists but is incorrectly implemented. The CVSS network attack vector (AV:N) indicates the vulnerable management interface or API is reachable over the network, consistent with PowerStore's REST-based management plane. The S:U (unchanged scope) metric confirms exploitation is contained within the PowerStore system itself.
Know when Powerstore 500T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management plane, low complexity, low-privilege account required; full triad impact appropriate for admin-level storage control.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation.
Executive ViewAI
Dell PowerStore storage appliances are vulnerable to privilege escalation that allows authenticated low-privilege users to perform administrator-level operations, potentially compromising the confidentiality, integrity, and availability of critical storage infrastructure. Organizations using PowerStore systems face risk of unauthorized data access, modification, or deletion by internal users or compromised service accounts. This vulnerability poses immediate threat to data protection compliance and business continuity in multi-tenant or shared-access storage environments.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface network access to authorized administrators only, implement multi-factor authentication for all storage management accounts, enable detailed audit logging of administrative API operations and privilege escalation attempts, enforce least-privilege principle for all user accounts, and regularly audit user permission assignments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Powerstore 500T
View allRemote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-boun
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network ac
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arb
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypas
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authoriz
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allow
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a
Exploit-DB