Dell PowerPath EUVD-2026-62419

Exploitation requires an existing local account with at minimum low-privilege access (PR:L per CVSS vector) on a Windows host running Dell PowerPath versions 7.2 through 8.0 SP1. The attack vector is strictly local (AV:L) - no network-based exploitation path exists. No special configuration or non-default feature enablement is described in the advisory as a prerequisite, suggesting the flaw is present in standard PowerPath installations. Exploitation is limited to the Windows platform per advisory scope. The Unchanged scope (S:U) means successful privilege escalation does not propagate to compromise adjacent systems or hypervisors. Key limiting factors: the attacker must have an established local session on the target host, and environments that restrict interactive local logins to administrators only eliminate the attack precondition entirely.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L accurately characterizes this as a constrained, local privilege escalation: the attacker must already hold a low-privileged account on the target Windows host, there is no remote attack surface, and the impact across confidentiality, integrity, and availability is limited. The Medium score of 5.3 is consistent with bounded post-exploitation impact that does not break process isolation. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified, placing this squarely in routine patch-cycle priority rather than emergency response. Environments with strong endpoint access controls - limiting local interactive logins on PowerPath hosts to authorized administrators only - face materially lower practical risk, since exploitation is gated on local account access.

A standard Windows domain user with a local session on a Dell PowerPath 7.2-8.0 SP1 host identifies a misconfigured service permission or writable privileged path exposed by the PowerPath installation, then invokes the vulnerable operation to execute code or spawn a process at elevated privilege. No public exploit code has been identified, so exploitation currently requires attacker-side research into the specific flaw mechanics. The local-only attack vector confines risk to hosts where non-administrative users have interactive access.