Dell PowerStore EUVD-2026-69303

Exploitation requires network reachability to the PowerStore SDNAS (software-defined NAS) service on an affected PowerStore T-series array running PowerStoreOS versions below 4.3.1.2-2771239 (confirmed affected builds include 4.1.0.0 through 4.1.0.5, 4.3.0.0, 4.3.1.0, and 4.3.1.1). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no special configuration, and no user interaction are required against the vulnerable component - the critical function is missing authentication by design (CWE-306). The primary LIMITING factor is network position: PowerStore is a datacenter storage appliance whose management and NAS data interfaces are normally segmented and not internet-exposed, so realistic exploitation depends on the attacker already having access to the storage/management network segment reachable by the SDNAS service.

This is a maximum-severity flaw (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rooted in CWE-306 Missing Authentication for a Critical Function in Dell PowerStore SDNAS, meaning a remote attacker needs no credentials, no user interaction, and only low attack complexity to reach a scope-changing total compromise of the filesystem. The real-world exploitation signals, however, are currently cool and partly conflicting with the raw score: EPSS is only 0.27% (20th percentile), and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total'. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is NOT yet evidence of mass or automated exploitation. The gap between a perfect 10.0 CVSS and a low EPSS/SSVC posture is best read as: the vulnerability is architecturally trivial to exploit once an attacker can route to the SDNAS service, but PowerStore is a datacenter storage appliance that is typically not internet-facing, which constrains the realistic automatable attack surface. Net assessment: treat as a HIGH-PRIORITY patch item for anyone running affected PowerStore T-series arrays - the 'total' technical impact plus missing-auth root cause makes it extremely dangerous if the management/data network is reachable by an attacker - but the absence of active exploitation and non-automatable SSVC rating mean it is an urgent-patch rather than emergency-in-the-wild scenario. A vendor patch is available (DSA-2026-330 / fixed in 4.3.1.2-2771239), which should drive prompt remediation.

An attacker with network access to a Dell PowerStore array's SDNAS service reaches a critical function that fails to enforce authentication and invokes it directly, with no credentials or user interaction, to gain access to the underlying filesystem and the data it holds. Because CVSS specifies PR:N/UI:N with a scope change, this requires only reachability of the exposed service rather than any foothold. No public exploit code has been identified at time of analysis, so exploitation would currently require an attacker to independently discover the unauthenticated function.