Dell PowerStore EUVD-2026-69299

Exploitation requires a valid low-privilege authenticated account on the affected Dell PowerStore appliance, consistent with CVSS PR:L. Local access to the appliance management interface or shell environment is required (AV:L) - remote unauthenticated exploitation is not supported by the vector. No user interaction is needed once the authenticated session is established (UI:N), and no race condition or special environmental configuration is required (AC:L). The key limiting factor is the prerequisite of prior local authentication: an attacker must control a valid low-privilege credential before exploitation is possible. No specific non-default configuration is documented as a prerequisite in available data beyond possession of such a credential.

The CVSS 8.8 score is credible: the scope change and full C:H/I:H/A:H triad accurately reflect that root on an enterprise storage appliance is tantamount to unrestricted access to every dataset the array serves. The primary risk-limiting factor is AV:L - this is not a remotely exploitable internet-facing flaw; an attacker must first obtain a local authenticated session, whether through credential theft, misuse of a service or monitoring account, or a prior foothold on an adjacent system with storage management access. EPSS data is not provided in available intelligence, and the vulnerability is not in the CISA KEV catalog, meaning no confirmed active exploitation exists at time of analysis. No public POC has been identified. Even a mid-sized enterprise storage team - the kind managing PowerStore arrays in a regional data center serving dozens of workloads - should treat this as urgent given the privilege escalation potential and the sensitivity of storage infrastructure. The AC:L metric means exploitation is straightforward once the prerequisite local access is obtained, with no race conditions or unusual environmental factors required. Risk is therefore high for environments where limited-privilege shell accounts are granted to multiple staff or automated systems.

An attacker who has obtained a low-privilege account on a Dell PowerStore appliance - through credential theft, misuse of a shared service account, or lateral movement from a compromised management host - submits crafted input containing shell metacharacters to a vulnerable command-handling component. The injected commands bypass the privilege boundary and execute as root, granting full control of the appliance OS, its storage pools, and all hosted data. No public exploit code exists at time of analysis, so exploitation currently requires attacker-developed tooling and prior authenticated local access.