Dell PowerStore EUVD-2026-69126

Exploitation requires network access to the Dell PowerStore management interface and valid credentials for any authenticated account with limited (low) privileges - there is no requirement for administrative rights. The CVSS vector PR:L confirms that standard, non-privileged authenticated users are sufficient. No special non-default configuration is required based on the description; the flaw is present in the platform's path handling logic regardless of deployment configuration. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot directly exploit this vulnerability without first obtaining credentials. This makes credential hygiene and MFA enforcement meaningful compensating controls prior to patching.

The CVSS score of 8.8 (High) is well-supported by the vector metrics: the vulnerability is network-reachable, requires no user interaction, demands only low privileges (a standard authenticated storage user), and carries high Confidentiality, Integrity, and Availability impact. No EPSS data is provided in the input, so exploitation probability cannot be quantified independently; however, arbitrary file write vulnerabilities with these characteristics historically attract rapid exploit development. The vulnerability is not listed in CISA KEV and no POC has been identified at time of analysis, which somewhat reduces immediate urgency. That said, the low complexity and minimal privilege bar mean that any authenticated user - including service accounts, backup operators, or compromised credentials obtained through phishing - could exploit this. Real-world risk is high for organizations where PowerStore is internet-exposed or where insider threat is a concern. The tag 'Information Disclosure' in the input metadata is a mislabel - this is an arbitrary write primitive, not a read/disclosure flaw.

An attacker who has obtained low-privileged credentials to a Dell PowerStore system - for example, via phishing a backup operator account or reusing leaked credentials - authenticates to the storage management API over the network and sends a crafted request with a manipulated filesystem path. By bypassing the platform's path validation controls, the attacker writes a malicious payload (such as a cron job, SSH authorized key, or configuration override) to a sensitive directory, achieving persistent access or privilege escalation on the appliance. No public POC has been identified at time of analysis.