EUVD-2026-53930
GHSA-q6r6-m9h6-qhjm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable IAPI command injection with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding root gives full C:H/I:H/A:H; scope unchanged as the OS is the vulnerable system.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
Articles & Coverage 1
AnalysisAI
Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch.
Technical ContextAI
VSI is a Dell plugin that integrates Dell storage arrays (Unity, PowerMax, PowerStore, VMAX-class) with the VMware vSphere Client, exposing management operations through its internal API layer (the IAPI component). CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that attacker-controlled input reaching IAPI is passed to a shell or system-call interface without adequate sanitization, so shell metacharacters or command separators can break out of the intended command and execute arbitrary commands. The single wildcard CPE (cpe:2.3:a:dell:virtual_storage_integrator_for_vmware_vsphere_client:*) shows Dell has not enumerated individual affected builds in the CPE data, but the description bounds the affected range as everything below 10.11.1.0. Because IAPI runs with root privileges on the underlying appliance OS, a successful injection inherits full system control rather than a constrained service account.
RemediationAI
Vendor-released patch: upgrade Dell Virtual Storage Integrator for VMware vSphere Client to version 10.11.1.0 or later, which is the fixed release per Dell advisory DSA-2026-335 (https://www.dell.com/support/kbdoc/en-us/000496035/dsa-2026-335-security-update-for-dell-virtual-storage-integrator-for-vmware-vsphere-client-multiple-vulnerabilities); Dell explicitly recommends upgrading at the earliest opportunity. Until the upgrade is applied, restrict network reachability of the VSI appliance and its IAPI component to a hardened management VLAN or jump host and block access from user and untrusted networks, since the exploit is network-based and unauthenticated - the trade-off is that legitimate remote administration must then route through the restricted path. Place the plugin behind firewall/ACL controls that permit only known vSphere management hosts to reach it, and monitor IAPI logs for anomalous command-injection patterns; note these are compensating controls only and do not remove the vulnerable code, so patching remains mandatory.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today