Dell PowerStore CVE-2026-79684

Exploitation requires a valid low-privilege account on the Dell PowerStore management interface, which must be reachable over the network (AV:N, PR:L per CVSS). No user interaction, no non-default configuration, and no special attack preparation beyond credential possession is required. The primary limiting factor is obtaining any authenticated session on the target appliance - unauthenticated external attackers cannot directly exploit this. Environments that isolate PowerStore management interfaces behind dedicated management networks or firewalls that restrict access to administrator workstations significantly reduce real-world exposure, as the management plane must be reachable from the attacker's position.

The CVSS 8.8 score is consistent with the attack profile: network-reachable, no complexity, no user interaction, only a low-privilege credential required, with full confidentiality, integrity, and availability impact upon success. This is not a case of inflated CVSS - the vector accurately reflects a straightforward authenticated privilege escalation on enterprise storage infrastructure. No EPSS score was provided in the input data, and no KEV listing or POC has been identified, which reduces immediate exploitation urgency compared to actively weaponized CVEs. However, the absence of version-range upper bounds in all CPE strings suggests no patched version has yet been captured in NVD data, meaning the entire installed base may remain exposed. Enterprise storage systems holding business-critical or regulated data are high-value targets; any organization running unpatched PowerStore appliances should treat remediation as urgent regardless of current exploitation status. The discrepancy between CPE coverage (through 7000T) and advisory tags (which also cite 9000T and 9200T) introduces uncertainty about the true scope - verify against DSA-2026-330.

An attacker who has obtained a low-privilege PowerStore account - for example, through credential reuse, phishing, or compromise of a monitoring service account - connects to the storage appliance's management interface over the network and sends a crafted request that the access restriction layer fails to properly enforce. The attacker's session is elevated to administrative or root-equivalent privileges, enabling modification of storage configurations, access to protected data volumes across all tenants, or disruption of storage services. No public exploit code has been identified, but the low attack complexity (AC:L) indicates exploitation does not require specialized tooling once the bypass method is understood.