Dell PowerScale InsightIQ CVE-2026-94348

Exploitation requires authenticated LOCAL access to the Dell PowerScale InsightIQ instance with at least low-level privileges (PR:L/AV:L), meaning the attacker must already have a valid, albeit unprivileged, foothold on the appliance before supplying malicious input to the vulnerable SQL-backed feature. No user interaction by a victim is required (UI:N), and no special non-default configuration is named in the advisory. The principal limiting factors are the local attack vector (no remote network exploitation) and the authentication requirement, which together confine exploitation to insiders or attackers who have already compromised a low-privileged account; the impact is further limited to Denial of Service rather than data compromise.

This is a genuinely moderate, not high-priority, issue despite being an SQL injection flaw. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, 6.1 Medium) tells a consistent story that aligns with the description: exploitation requires LOCAL access (AV:L) and existing LOW privileges (PR:L), and the impact is weighted toward availability (A:H) with only limited integrity impact (I:L) and NO confidentiality impact (C:N). This is unusual for SQLi, which typically yields data exposure - here the realistic outcome is Denial of Service, not data theft, which the C:N rating confirms. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no evidence of active or probable exploitation. The combination of local-only vector, required authentication, and DoS-only impact means this is a lower-urgency patch than a network-facing, unauthenticated, RCE-grade SQLi. The signals are internally consistent - no contradictions between the CVSS vector and the description - so confidence in the moderate rating is reasonable.

An attacker who already holds a low-privileged local account on the Dell PowerScale InsightIQ appliance submits crafted input into a field that is unsafely concatenated into an SQL query, injecting special elements that corrupt or overload query processing and crash or hang the backend database/service. No public proof-of-concept was provided, and the local access plus authentication requirements (AV:L/PR:L) significantly limit who can attempt this.