Unisphere for PowerMax EUVD-2026-101026

Exploitation requires the attacker to already possess high-privilege (administrative) access to the Dell Unisphere for PowerMax virtual appliance (PR:H), reachable over the network (AV:N) with no user interaction (UI:N) but under high attack complexity (AC:H). The flaw is limited to the affected 9.2.4.x versions of the Unisphere for PowerMax vApp. Key limiting factors: the high-privilege precondition restricts this to insiders or attackers who have already compromised an admin account, and the high attack complexity implies additional conditions or non-trivial preparation are needed - so this is not a remote-unauthenticated mass-exploitation candidate.

This is a moderate-severity issue (CVSS 6.6) that should be prioritized well below internet-facing unauthenticated flaws. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: although the attack vector is network-based, exploitation requires HIGH privileges (PR:H - i.e., an already-authenticated administrative/high-privilege user of the appliance) AND high attack complexity (AC:H), which together substantially constrain real-world exploitability. The high-privilege precondition means the primary threat model is privilege-boundary escape or malicious/compromised administrator rather than opportunistic remote attack. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code; the exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both agree on remote access by a high-privileged attacker. Net assessment: a real but lower-tier priority; patch on a normal maintenance cycle unless the affected appliance is exposed to untrusted or semi-trusted administrators.

An attacker who already holds high-privilege (administrative) credentials on the Dell Unisphere for PowerMax virtual appliance submits crafted input to a management function that fails to neutralize shell metacharacters, causing injected operating-system commands to execute on the appliance. Because attack complexity is high, success likely depends on specific conditions or timing, and no public proof-of-concept exploit is known at the time of analysis.