Container Storage Modules EUVD-2026-93429

Exploitation requires network reachability to a Dell Container Storage Modules instance running a version prior to 1.18.0 that exposes the affected critical function lacking authentication; per AV:N/AC:L/PR:N/UI:N this needs no credentials, no user interaction, and works against affected deployments without special difficulty. The primary LIMITING factor is network exposure of the vulnerable CSM endpoint - in typical Kubernetes deployments CSM components may be internal to the cluster, so the realistic blast radius depends on whether the vulnerable service is reachable from an attacker-controlled network segment; the only hard remediation gate is upgrading to CSM 1.18.0 or later. The exact critical function and interface are not named in the advisory description provided.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximal 10.0: network-reachable, low complexity, no privileges, no user interaction, with a scope change and full confidentiality/integrity/availability impact. CWE-306 (Missing Authentication for Critical Function) is consistent with the description of an unauthenticated remote attacker achieving elevation of privileges, so the signals are internally coherent rather than conflicting. However, several exploitation-pressure signals are MISSING from the input: there is no EPSS probability provided, the vulnerability is not listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation is 'no public exploit identified at time of analysis.' The net picture is a critical, trivially-exploitable flaw whose theoretical risk is maximal but whose observed real-world exploitation is currently unproven; the scope-change elevation of privileges in a Kubernetes storage layer makes it a strong patch-now candidate despite the absence of KEV/EPSS/POC corroboration.

An attacker with network reachability to an exposed Dell Container Storage Modules endpoint (e.g., a CSM management or sidecar API reachable within or at the edge of a Kubernetes cluster) invokes a critical function that fails to enforce authentication, without any credentials or user interaction. Because the CVSS scope is changed (S:C), the attacker leverages this to elevate privileges beyond the vulnerable component into the surrounding cluster/storage control plane. No public exploit code is identified at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop.