What is the CVSS score of EUVD-2026-28592?

EUVD-2026-28592 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28592?

Yes, a patch is available for EUVD-2026-28592. Update the affected software to the latest version immediately.

Dell PowerScale OneFS EUVD-2026-28592

| CVE-2026-32803 LOW

Insufficient Logging (CWE-778)

2026-05-08 security_alert@emc.com

GHSA-h5fg-9m4r-vrcj

Dell Information Disclosure

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 08, 2026 - 15:02 EUVD

Analysis Generated

May 08, 2026 - 14:32 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

LOW 3.3

DescriptionCVE.org

Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

AnalysisAI

Dell PowerScale OneFS versions 9.5.0.0 through 9.12.0.1 contain an insufficient logging vulnerability that allows low-privileged local attackers to tamper with information without generating adequate audit trails, enabling attack obfuscation and compliance violation. The vulnerability affects multiple version branches across OneFS 9.5 through 9.12, with no public exploit code identified at time of analysis. CVSS score of 3.3 reflects low-to-medium integrity impact with local access requirement and low complexity.

Technical ContextAI

Dell PowerScale OneFS is a clustered file system and NAS operating system providing storage management for enterprise environments. The vulnerability stems from insufficient audit logging (CWE-778) in affected OneFS versions, meaning that certain system activities or configuration changes do not generate adequate log entries for forensic or compliance purposes. This allows attackers to perform unauthorized actions while evading detection and accountability mechanisms that rely on audit trail review. The issue affects the logging infrastructure itself rather than a specific cryptographic or protocol implementation, making it a systemic control weakness across multiple OneFS components or modules.

RemediationAI

Apply the security update provided by Dell per advisory DSA-2026-172, upgrading to patched OneFS versions beyond the affected ranges: upgrade from 9.5.x to 9.5.2.0 or later, from 9.6/9.7.x to 9.7.1.14 or later, from 9.8/9.9/9.10.x to 9.10.1.6 or later, or from 9.11/9.12.x to 9.12.0.2 or later (consult the advisory for exact patched version numbers). Before patching, restrict low-privileged user access to OneFS administrative interfaces and audit log locations via role-based access control (RBAC) and file system permissions, though this does not eliminate the underlying logging gap. Implement centralized syslog forwarding to an immutable off-cluster logging destination (SIEM or dedicated log server) with write-once storage, ensuring that even if local logs are tampered with, off-cluster records remain intact for forensic review. Monitor and alert on audit log size changes, gaps in log timestamps, or repeated archive deletions that might indicate tampering. Schedule patching within 60 days for regulated environments and 90 days for non-critical deployments, as the attack surface is limited to local low-privilege users.