Dell CSM EUVD-2026-93458

Exploitation requires the attacker to hold an adjacent network position (AV:A - same logical/broadcast segment or an on-path location between clients and the Dell CSM proxy-server) and to actively perform a man-in-the-middle interception of the proxy-server's TLS traffic, exploiting the component's failure to properly validate certificates (CWE-295). No authentication is required (PR:N) and no user interaction is needed (PR:N/UI:N). Exploitation is LIMITED by the high attack complexity (AC:H) inherent in achieving reliable MITM positioning and TLS impersonation, by the adjacency requirement (not routable from the broader internet), and by the requirement that CSM be at a version prior to 1.18.0; environments that isolate CSM proxy-server traffic to a trusted segment substantially reduce real-world exposure.

This is a credible but conditional priority rather than a drop-everything emergency. The vendor-provided CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L, 8.2 High) tells a consistent story: exploitation is unauthenticated (PR:N) and requires no user interaction, but is constrained to an adjacent network position (AV:A) and carries high attack complexity (AC:H) - consistent with the CWE-295 improper certificate validation flaw, which realistically demands a man-in-the-middle position to intercept and impersonate the proxy-server's TLS endpoint. The scope change (S:C) and C:H are well justified because the exposed asset is storage backend administrator credentials, which belong to a different security authority than the CSM proxy itself. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are simply absent rather than low. The main tension is between the High base score and the real-world friction (adjacent-only access plus MITM positioning plus AC:H), which together make opportunistic mass exploitation unlikely and favor targeted scenarios by an attacker already on an adjacent segment. Prioritize patching in environments where the CSM proxy-server traffic traverses shared or less-trusted network segments.

An attacker who has gained a foothold on a network segment adjacent to the Kubernetes cluster running Dell CSM positions themselves to intercept traffic to the proxy-server component. Because the proxy-server does not properly validate certificates, the attacker presents a fraudulent certificate and transparently man-in-the-middles the TLS session, capturing the storage backend administrator credentials in transit. No public exploit code was identified in the provided data, and the AV:A/AC:H metrics mean the attacker must already hold an adjacent position and successfully execute the MITM.