Dell PowerFlex Manager EUVD-2026-42871

Exploitation requires the attacker to already hold high-privilege (administrative) access to Dell PowerFlex Manager (CVSS PR:H) and network reachability to its management interface (AV:N), with no user interaction needed (UI:N). The concrete trigger is the appliance's OS Repository processing path, where attacker-supplied input is passed to an OS command - so the attacker must be able to influence data handled during OS Repository operations. Limiting factors: the high-privilege prerequisite excludes unauthenticated and low-privileged users, meaning this is realistically a post-compromise, insider, or over-delegated-admin scenario rather than opportunistic remote exploitation; all versions below 5.1.0.1 are exposed regardless of configuration.

The CVSS 3.1 base score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but requiring high privileges (PR:H), with a scope change reflecting impact beyond the appliance into managed infrastructure. The dominant limiting factor is the PR:H requirement: an attacker must already hold high-privilege/administrative access to PowerFlex Manager, which meaningfully constrains who can exploit this and downgrades it from a mass-exploitation concern to a privilege-escalation/insider or post-compromise threat. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input; treat exploitation likelihood as unconfirmed. The scope-change plus root-level command execution makes technical impact severe if the privilege prerequisite is met, so this warrants prompt patching in environments where PowerFlex Manager admin access is broadly delegated, but it is not an unauthenticated internet-facing emergency.

An attacker who has obtained or been granted high-privilege access to PowerFlex Manager submits crafted input that is processed by the OS Repository function, embedding shell metacharacters that break out into arbitrary commands executed as root on the appliance. From that root foothold they pivot into the managed PowerFlex nodes and storage fabric. No public exploit code has been identified at time of analysis, so this scenario is derived from the CVSS vector and description rather than a demonstrated POC.