Container Storage Modules EUVD-2026-93466

Exploitation requires the attacker to have adjacent network access (AV:A) - i.e., a position on the same logical/physical network segment as the Kubernetes cluster running a vulnerable Dell CSI driver (csi-powerflex, csi-powermax, or csi-powerstore) at a version prior to 1.18.0; it is NOT reachable from an arbitrary remote internet host. No authentication and no user interaction are needed (PR:N/UI:N), and the affected CSI functions are vulnerable in their deployed state per the description (no non-default configuration toggle is named). Limiting factors: the adjacency requirement substantially narrows the attacker population, the impact is confined to information disclosure (no integrity or availability loss), and only environments that have actually deployed these three Dell CSI drivers alongside the corresponding Dell storage arrays are affected.

Multiple signals converge on this being a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 7.4) describes a low-complexity, unauthenticated attack limited to an adjacent network (not the open internet) with a scope change that yields high confidentiality impact but no integrity or availability impact. CISA's SSVC framework agrees on the muted urgency: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial - consistent with information disclosure rather than full compromise. EPSS reinforces this at just 0.30% (21st percentile), and the vulnerability is NOT in CISA KEV and has no known public exploit. The signals are mutually consistent: a real, patchable flaw worth remediating during normal maintenance, but the adjacency requirement (AV:A) and absence of any exploitation evidence argue against treating it as a drop-everything item. No signals conflict. The only caveat is that the description only says 'information disclosure' without specifying what data is exposed, so the real-world blast radius of the C:H rating cannot be fully verified from the provided data.

An attacker who has already gained a foothold on the same logical/adjacent network as a Kubernetes cluster running Dell Container Storage Modules (the csi-powerflex, csi-powermax, or csi-powerstore drivers) sends requests to a CSI component endpoint that lacks authentication, retrieving sensitive information without any credentials or user interaction. No public exploit code has been identified at time of analysis, so exploitation would require independent research into the exposed endpoint.