Dell CSM EUVD-2026-93428

Exploitation requires that the Dell CSM Authorization module be deployed and that its csm-authorization-storage gRPC server be network-reachable from the attacker; one or more storage arrays must be registered so that administrator credentials exist to steal. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and default-configured deployments of the authorization module are affected. The primary limiting factors are therefore environmental: the optional Authorization module must be in use, the gRPC port must be exposed to the attacker's network position, and arrays must already be onboarded - segmentation of the gRPC service from untrusted networks meaningfully reduces exposure.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk paper cut. The Dell-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a maximally severe case: network-reachable, low-complexity, unauthenticated (PR:N), no user interaction, with a scope change because exploitation leaks credentials for separate security authorities (the storage arrays). CWE-306 (Missing Authentication for Critical Function) is consistent with the description and with the PR:N rating - the gRPC server simply fails to authenticate callers. The real amplifier is impact: a single unauthenticated request exposes storage backend administrator credentials for ALL registered arrays, so the I:H/A:H ratings are driven by downstream credential abuse rather than a direct write primitive. No EPSS score, KEV listing, or public POC is present in the provided data, so there is NO evidence of active exploitation yet - exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent (vendor CVSS aligns with the description) but incomplete on the exploitation-likelihood axis: severity and exploitability are near-maximal, while real-world weaponization is unmeasured. Treat as urgent to patch given the trivial exploitation path and critical blast radius, while noting that widespread automated exploitation has not been demonstrated in the supplied intelligence.

An attacker with network reach to a Kubernetes cluster running the Dell CSM Authorization module connects directly to the csm-authorization-storage gRPC endpoint and issues requests without any credentials. Because authentication is missing entirely, the server returns the stored administrator credentials for every registered storage array, which the attacker then reuses to take full administrative control of the backend storage. No public exploit was identified in the provided data, but the low complexity and lack of authentication make a working exploit trivial to develop.