Dell
Monthly
Missing brute-force rate-limiting in Dell Secure Connect Gateway (SCG) 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) exposes authentication endpoints to unlimited credential-guessing by unauthenticated remote attackers over the network. Successful exploitation allows an attacker to enumerate and compromise valid credentials, with Dell indicating the resulting access can enable client-side request forgery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service via compression bomb in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed payloads that expand dramatically upon decompression. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Path traversal in Dell Secure Connect Gateway (SCG) 5.0 exposes restricted filesystem paths to unauthenticated remote attackers across both Appliance and Application deployment variants. The vulnerability (CWE-22) allows directory escape via crafted request paths, resulting in unauthorized access to files outside the intended serving root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the unauthenticated network-accessible attack surface and low complexity make this a credible priority for enterprise Dell infrastructure operators.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a network-positioned unauthenticated attacker to conduct man-in-the-middle attacks, intercepting and potentially modifying encrypted communications between the SCG and Dell's remote support infrastructure. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation yields high confidentiality and integrity impact on all intercepted support traffic.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated network-positioned attacker to conduct man-in-the-middle attacks against both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment forms, intercepting and potentially tampering with encrypted remote-support communications to achieve unauthorized access. Dell confirmed the vulnerability under advisory DSA-2026-382 with a CVSS 7.7 (High) rating; the AC:H metric reflects the MITM positioning prerequisite, which is the primary exploitation barrier. No public exploit code has been identified at time of analysis.
Remote code execution via a download-without-integrity-check flaw affects Dell Secure Connect Gateway (SCG) 5.0 in both its Appliance and Application deployment forms. An unauthenticated network-adjacent attacker who can achieve a man-in-the-middle position between the SCG system and Dell's update infrastructure can substitute malicious code for legitimate downloads, leading to command execution on the appliance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) captures the high attack complexity from the MITM requirement alongside the absence of authentication prerequisites. No public exploit has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to coerce the appliance or application into issuing arbitrary HTTP/HTTPS requests to internal or external destinations, leading to unauthorized access to internal network services, cloud metadata endpoints, or other back-end resources not intended for external exposure. Both the Appliance and Application deployment modes are affected across all versions prior to the fixed releases. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforwardly exploitable against any internet- or intranet-accessible instance.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a low-privileged authenticated remote attacker to inject arbitrary OS commands and escalate to full system control, achieving complete confidentiality, integrity, and availability compromise. Both the SCG 5.0 Appliance (fixed in 5.36.00.16) and SCG 5.0 Application (fixed in 5.36.00.00) variants are affected. No public exploit identified at time of analysis, and the high attack complexity (AC:H) suggests a specific condition or non-trivial technique is required beyond simple credential possession.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to exploit TLS/certificate handling weaknesses, leading to unauthorized access and high-availability impact. Both the Appliance (Virtual Edition) builds prior to 5.36.00.16 and Application builds prior to 5.36.00.00 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network vector and CVSS 8.2 score make this a priority patching item for environments running Dell infrastructure monitoring.
Improper certificate validation in Dell Secure Connect Gateway 5.0 exposes both Appliance and Application deployments to unauthenticated remote exploitation, enabling MITM-style attacks that bypass TLS trust enforcement and grant unauthorized access to communications relayed through the gateway. The Appliance variant is affected below version 5.36.00.16 and the Application variant below 5.36.00.00. No active exploitation has been confirmed by CISA KEV and no public exploit code is referenced, but the zero-authentication network vector makes patching urgent for any internet-reachable SCG deployment.
Server-Side Request Forgery in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to cause denial of service against both the Application and Appliance (Virtual Edition) deployment forms. The CVSS vector confirms fully unauthenticated network exploitation with no user interaction, targeting availability exclusively - confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile, and the CISA SSVC assessment lists exploitation status as none.
Certificate hostname validation failure in Dell Secure Connect Gateway (SCG) 5.0 enables an unauthenticated remote attacker positioned as a network man-in-the-middle to present a valid TLS certificate for a different host, defeating the connection's trust model and gaining unauthorized access to intercepted communications. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are confirmed affected per Dell DSA-2026-382. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H CVSS metric reflects the non-trivial network positioning prerequisite.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables an unauthenticated remote attacker with a man-in-the-middle network position to intercept and modify encrypted communications between the SCG platform and Dell's support infrastructure. Rated CVSS 7.4 (CWE-295) with high confidentiality and integrity impact, this flaw is particularly sensitive given that SCG routinely carries privileged support telemetry and credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released patches in advisory DSA-2026-382.
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Improper Certificate Validation (CWE-295) in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated attacker positioned on the same network segment to intercept or manipulate TLS-protected communications, leading to unauthorized access to sensitive data or remote-support sessions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. The CVSS AV:A vector confirms this is not a direct internet exploit - the attacker must be adjacent to the network segment hosting the SCG deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a high-privileged remote attacker to inject arbitrary OS commands through the application's management interface, achieving privilege escalation beyond the application boundary to OS-level access. Both the SCG 5.0 Appliance (prior to 5.36.00.16) and SCG 5.0 Application (prior to 5.36.00.00) are affected, confirmed by Dell advisory DSA-2026-382. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Dell has released patched versions for both product variants.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes both Appliance and Application variants to protection mechanism bypass by unauthenticated remote attackers. The flaw (CWE-295) allows an adversary in a network-interception position to present an invalid or attacker-controlled TLS certificate that the SCG accepts without proper verification, potentially enabling interception or manipulation of communications between the gateway and backend or managed systems. Patch availability is confirmed via Dell advisory DSA-2026-382; no public exploit or CISA KEV listing is present at time of analysis.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Improper TLS certificate validation in Dell Secure Connect Gateway 5.0 allows an unauthenticated remote attacker occupying a man-in-the-middle network position to intercept and tamper with encrypted SCG communications, leading to unauthorized access. Both the physical Appliance variant (fixed in 5.36.00.16) and the virtual Application variant (fixed in 5.36.00.00) are affected across all 5.0.x releases preceding those thresholds, per Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations to remote unauthenticated attackers, enabling unauthorized access that yields high integrity impact and limited confidentiality exposure. Both deployment forms - the virtual Appliance (prior to 5.36.00.16) and the Application (prior to 5.36.00.00) - are affected. Dell has released patches via advisory DSA-2026-382; no public exploit or CISA KEV listing exists at time of analysis, but the attack path (AV:N/AC:L/PR:N/UI:N) requires minimal attacker capability.
Unauthenticated remote exploitation of Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) - exposes a critical function with no authentication gate, allowing a network-adjacent or internet-facing attacker to trigger high-availability-impact operations without any credentials. Dell's advisory DSA-2026-382 classifies this under CWE-306 (Missing Authentication for Critical Function), indicating the affected endpoint simply lacks access control rather than having a bypassable one. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the fully unauthenticated network vector with low complexity represents a credible operational risk for any exposed SCG deployment.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to bypass TLS protection mechanisms, enabling man-in-the-middle interception or modification of communications to and from the gateway. Both the Appliance form factor (versions prior to 5.36.00.16) and Application form factor (versions prior to 5.36.00.00) are confirmed affected by Dell advisory DSA-2026-382. No public exploit code exists and EPSS scoring of 0.14% (4th percentile) reflects very low current exploitation probability, consistent with SSVC's 'none' exploitation status.
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse directory boundaries and achieve remote code execution on affected systems. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and Dell has issued a patch under advisory DSA-2026-382.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly validate TLS certificates (CWE-295), affecting the Appliance edition before 5.36.00.16 and the Application edition before 5.36.00.00. An unauthenticated network attacker able to intercept or interpose on connections can defeat the trust chain and gain access to protected resources or data. A vendor patch is available (DSA-2026-382); no public exploit identified at time of analysis and EPSS is low (0.15%).
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE-306), enabling an unauthenticated remote attacker to achieve full confidentiality, integrity, and availability compromise against affected deployments. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed vulnerable per Dell advisory DSA-2026-382 and EUVD-2026-72375. No public exploit has been identified at time of analysis; Dell has released patches for both deployment forms.
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthenticated remote attackers to a full-compromise pathway culminating in remote code execution. Both hardware appliance deployments (prior to 5.36.00.16) and software/virtual application deployments (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis; EPSS exploitation probability stands at 0.53%, and SSVC classifies exploitation status as none.
Hard-coded credentials embedded in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote compromise. A network-accessible attacker who discovers or obtains the static credentials can authenticate without any supplied privileges and gain unauthorized access with high confidentiality and integrity impact. No public exploit or active CISA KEV listing has been identified at time of analysis; Dell has confirmed the vulnerability and released fixed versions via advisory DSA-2026-382.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated OS command injection in Dell Secure Connect Gateway (SCG) 5.0 Application (versions prior to 5.36.00.00) exposes affected systems to remote code execution by any network-reachable attacker. The flaw (CWE-78) allows injection of shell metacharacters through an unspecified application input that is passed unsanitized to a system call, enabling arbitrary command execution on the gateway host. Dell has released version 5.36.00.00 via advisory DSA-2026-382; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. No public exploit or CISA KEV listing exists at time of analysis.
Dell PowerStore SDNAS (software-defined NAS) on PowerStoreOS builds earlier than 4.3.1.2-2771239 exposes a critical function that performs no authentication check, so an unauthenticated remote attacker who can reach the array's NAS service can gain full filesystem access - reading, modifying, or destroying stored data with no credentials and no user interaction (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Realistic exploitation is bounded by network position: PowerStore is a datacenter storage appliance whose NAS and management interfaces are normally segmented and not internet-facing, so an attacker would generally need pre-existing access to the storage or management network segment that can reach SDNAS. No public exploit code has been identified, CISA SSVC rates exploitation as 'none', EPSS is 0.27% (20th percentile), and a vendor patch (PowerStoreOS 4.3.1.2-2771239 or later) is already available per Dell advisory DSA-2026-330.
OS command injection in Dell PowerStore allows a locally authenticated user with limited privileges to execute arbitrary commands with root privileges, achieving full appliance compromise. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) confirms low-complexity local privilege escalation with scope change to root, covering complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full impact triad make this a meaningful risk for environments where multiple accounts share local PowerStore access.
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authorization controls and gain high-level access to the management plane. Affecting at least ten PowerStore hardware models across the T-series and Q-series lines, the flaw stems from incorrect authorization checks (CWE-863) - the system fails to enforce role boundaries on certain operations, allowing a low-privileged session to invoke privileged actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 8.8 score and full C/I/A impact make this a high-priority remediation item for any enterprise running PowerStore.
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arbitrary operating system commands with root privileges, achieving full appliance compromise. The CVSS scope-change metric (S:C) reflects that root access on a storage platform threatens all data hosted on the array, extending blast radius beyond the appliance itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity once local access is established makes this a priority remediation for organizations running affected PowerStore T and Q series hardware.
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges to execute arbitrary code at the operating system's highest privilege level. Affecting the full PowerStore T and Q product families (500T through 7000T confirmed via CPE), this CWE-829 flaw exploits the inclusion of functionality from an untrusted control sphere - meaning a low-privileged local user can influence a privileged execution path by supplying or manipulating untrusted code or configuration loaded by a higher-privileged process. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypass the platform's access control enforcement and gain elevated system privileges. Classified as CWE-693 (Protection Mechanism Failure), the flaw resides in the protection layer governing role-based access within the PowerStore management stack, spanning at least ten appliance models from the 500T to the 7000T series. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, though network access with valid limited-privilege credentials is required; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges to execute arbitrary commands at the root level, achieving full privilege escalation on the appliance. The CVSS scope change (S:C) reflects that root access on a storage platform extends impact beyond the immediate process boundary to the entire appliance and potentially dependent workloads. Dell has published advisory DSA-2026-330, but no specific patched version was provided in available data. No public exploit identified at time of analysis.
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access restriction controls and gain elevated system privileges, classified under CWE-693 (Protection Mechanism Failure). The entire PowerStore T-series and Q-series lineup is affected, with a network-accessible, low-complexity attack path requiring only a valid account. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score and broad appliance coverage make this a material risk in enterprise storage environments.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file write in Dell PowerStore allows authenticated low-privileged users to write attacker-controlled content to arbitrary filesystem paths via a Protection Mechanism Failure (CWE-693). Exploitation requires only network access and limited credentials, making this a credible lateral movement or privilege escalation vector within storage environments. No public exploit code has been identified at time of analysis, but the low complexity and low privilege bar make this a realistic threat against enterprise storage infrastructure.
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administrator-only management operations via the network, resulting in full confidentiality, integrity, and availability compromise of the storage system. The flaw stems from incorrect authorization checks (CWE-863), where the system fails to enforce proper privilege boundaries on API or management interface operations. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and high-impact CVSS 8.8 rating make this a credible threat in multi-tenant or shared-access storage environments.
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to execute arbitrary operating system commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a valid low-privileged credential, with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.
OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so severity is driven by impact rather than confirmed activity.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local attacker through a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires only a local low-privileged account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a remediated version (5.7.1) per advisory DSA-2026-309.
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions prior to 5.7.1, allowing a low-privileged authenticated user to gain unauthorized read and write access to filesystem resources owned or managed by DCU. The flaw stems from overly permissive ACLs set during installation, consistent with CWE-276, and carries a CVSS 7.8 High rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated system access by exploiting missing authorization checks. The vulnerability carries a CVSS 3.1 score of 8.8 with a scope change (S:C), indicating the privilege escalation extends beyond the DCU process itself - likely to OS-level or other system components. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction make this straightforward to exploit for any user with a local account.
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged attacker exploiting a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The vulnerability allows an attacker who already has a local foothold on the system to manipulate a resource between the time it is checked and the time it is used by the update utility, resulting in full system compromise (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 on local systems. A low-privileged local attacker can exploit unsafe deserialization to execute arbitrary code at a higher privilege level, potentially gaining full system control. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score and straightforward attack complexity make this a meaningful patching priority for enterprise fleets.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to fully compromise system confidentiality, integrity, and availability through unsafe deserialization of attacker-controlled data. The root cause is CWE-502 (Deserialization of Untrusted Data), a class of vulnerability where malicious serialized objects can trigger unintended code paths during deserialization, resulting in privilege escalation on Dell client endpoints. Dell has released version 5.7.1 as a fix per advisory DSA-2026-309; no public exploit or active exploitation has been identified at time of analysis.
OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability stems from improper neutralization of special elements passed to OS commands (CWE-78), resulting in full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the vendor self-disclosed this via Dell Security Advisory DSA-2026-096, indicating a confirmed code-level flaw.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privileges in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 allows a low-privileged local user to gain higher system access by exploiting a Least Privilege Violation (CWE-272). The application operates with or invokes components carrying excessive privileges, which a local attacker can abuse through an interaction-dependent trigger to achieve full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full C:H/I:H/A:H triad indicates complete system compromise potential if the privilege boundary is crossed successfully.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a mapped host connected to the array to read from or write to LUNs beyond those assigned to that initiator, effectively nullifying per-initiator LUN masking. Affected models span the full PowerStore T and Q product lines (500T through 7000T and beyond), as disclosed by Dell under advisory DSA-2026-330. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact triplet reflects the severity of unrestricted storage access, particularly in multi-tenant or converged infrastructure environments where multiple workloads share the same array.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Privilege escalation in Dell Watchdog Timer Driver versions prior to 2.0.0.1 allows a local low-privileged attacker to gain full system control by abusing an improperly access-controlled IOCTL interface exposed by the kernel driver. The CVSS scope-changed score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) reflects that exploitation crosses the kernel trust boundary, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a meaningful local privilege escalation risk on Dell-equipped systems.
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.
Missing brute-force rate-limiting in Dell Secure Connect Gateway (SCG) 5.0 Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) exposes authentication endpoints to unlimited credential-guessing by unauthenticated remote attackers over the network. Successful exploitation allows an attacker to enumerate and compromise valid credentials, with Dell indicating the resulting access can enable client-side request forgery. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service via compression bomb in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed payloads that expand dramatically upon decompression. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Path traversal in Dell Secure Connect Gateway (SCG) 5.0 exposes restricted filesystem paths to unauthenticated remote attackers across both Appliance and Application deployment variants. The vulnerability (CWE-22) allows directory escape via crafted request paths, resulting in unauthorized access to files outside the intended serving root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the unauthenticated network-accessible attack surface and low complexity make this a credible priority for enterprise Dell infrastructure operators.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application allows a network-positioned unauthenticated attacker to conduct man-in-the-middle attacks, intercepting and potentially modifying encrypted communications between the SCG and Dell's remote support infrastructure. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00, as confirmed by Dell advisory DSA-2026-382. No public exploit code or CISA KEV listing exists at time of analysis, but successful exploitation yields high confidentiality and integrity impact on all intercepted support traffic.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated network-positioned attacker to conduct man-in-the-middle attacks against both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment forms, intercepting and potentially tampering with encrypted remote-support communications to achieve unauthorized access. Dell confirmed the vulnerability under advisory DSA-2026-382 with a CVSS 7.7 (High) rating; the AC:H metric reflects the MITM positioning prerequisite, which is the primary exploitation barrier. No public exploit code has been identified at time of analysis.
Remote code execution via a download-without-integrity-check flaw affects Dell Secure Connect Gateway (SCG) 5.0 in both its Appliance and Application deployment forms. An unauthenticated network-adjacent attacker who can achieve a man-in-the-middle position between the SCG system and Dell's update infrastructure can substitute malicious code for legitimate downloads, leading to command execution on the appliance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) captures the high attack complexity from the MITM requirement alongside the absence of authentication prerequisites. No public exploit has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to coerce the appliance or application into issuing arbitrary HTTP/HTTPS requests to internal or external destinations, leading to unauthorized access to internal network services, cloud metadata endpoints, or other back-end resources not intended for external exposure. Both the Appliance and Application deployment modes are affected across all versions prior to the fixed releases. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforwardly exploitable against any internet- or intranet-accessible instance.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a low-privileged authenticated remote attacker to inject arbitrary OS commands and escalate to full system control, achieving complete confidentiality, integrity, and availability compromise. Both the SCG 5.0 Appliance (fixed in 5.36.00.16) and SCG 5.0 Application (fixed in 5.36.00.00) variants are affected. No public exploit identified at time of analysis, and the high attack complexity (AC:H) suggests a specific condition or non-trivial technique is required beyond simple credential possession.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to exploit TLS/certificate handling weaknesses, leading to unauthorized access and high-availability impact. Both the Appliance (Virtual Edition) builds prior to 5.36.00.16 and Application builds prior to 5.36.00.00 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network vector and CVSS 8.2 score make this a priority patching item for environments running Dell infrastructure monitoring.
Improper certificate validation in Dell Secure Connect Gateway 5.0 exposes both Appliance and Application deployments to unauthenticated remote exploitation, enabling MITM-style attacks that bypass TLS trust enforcement and grant unauthorized access to communications relayed through the gateway. The Appliance variant is affected below version 5.36.00.16 and the Application variant below 5.36.00.00. No active exploitation has been confirmed by CISA KEV and no public exploit code is referenced, but the zero-authentication network vector makes patching urgent for any internet-reachable SCG deployment.
Server-Side Request Forgery in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to cause denial of service against both the Application and Appliance (Virtual Edition) deployment forms. The CVSS vector confirms fully unauthenticated network exploitation with no user interaction, targeting availability exclusively - confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile, and the CISA SSVC assessment lists exploitation status as none.
Certificate hostname validation failure in Dell Secure Connect Gateway (SCG) 5.0 enables an unauthenticated remote attacker positioned as a network man-in-the-middle to present a valid TLS certificate for a different host, defeating the connection's trust model and gaining unauthorized access to intercepted communications. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are confirmed affected per Dell DSA-2026-382. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H CVSS metric reflects the non-trivial network positioning prerequisite.
Improper certificate validation in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables an unauthenticated remote attacker with a man-in-the-middle network position to intercept and modify encrypted communications between the SCG platform and Dell's support infrastructure. Rated CVSS 7.4 (CWE-295) with high confidentiality and integrity impact, this flaw is particularly sensitive given that SCG routinely carries privileged support telemetry and credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released patches in advisory DSA-2026-382.
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Improper Certificate Validation (CWE-295) in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated attacker positioned on the same network segment to intercept or manipulate TLS-protected communications, leading to unauthorized access to sensitive data or remote-support sessions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. The CVSS AV:A vector confirms this is not a direct internet exploit - the attacker must be adjacent to the network segment hosting the SCG deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a high-privileged remote attacker to inject arbitrary OS commands through the application's management interface, achieving privilege escalation beyond the application boundary to OS-level access. Both the SCG 5.0 Appliance (prior to 5.36.00.16) and SCG 5.0 Application (prior to 5.36.00.00) are affected, confirmed by Dell advisory DSA-2026-382. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Dell has released patched versions for both product variants.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 exposes both Appliance and Application variants to protection mechanism bypass by unauthenticated remote attackers. The flaw (CWE-295) allows an adversary in a network-interception position to present an invalid or attacker-controlled TLS certificate that the SCG accepts without proper verification, potentially enabling interception or manipulation of communications between the gateway and backend or managed systems. Patch availability is confirmed via Dell advisory DSA-2026-382; no public exploit or CISA KEV listing is present at time of analysis.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible through a logic flaw rooted in CWE-480 (Use of Incorrect Operator), affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00). The incorrect operator in a security-relevant conditional-likely an authentication or authorization check-produces a logic outcome that permits access without valid credentials, consistent with the CVSS PR:N vector and the 'Authentication Bypass' classification. Real-world impact spans limited confidentiality, integrity, and availability loss per the CVSS L/L/L impact ratings; no public exploit code or CISA KEV entry has been identified at time of analysis.
Improper TLS certificate validation in Dell Secure Connect Gateway 5.0 allows an unauthenticated remote attacker occupying a man-in-the-middle network position to intercept and tamper with encrypted SCG communications, leading to unauthorized access. Both the physical Appliance variant (fixed in 5.36.00.16) and the virtual Application variant (fixed in 5.36.00.00) are affected across all 5.0.x releases preceding those thresholds, per Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations to remote unauthenticated attackers, enabling unauthorized access that yields high integrity impact and limited confidentiality exposure. Both deployment forms - the virtual Appliance (prior to 5.36.00.16) and the Application (prior to 5.36.00.00) - are affected. Dell has released patches via advisory DSA-2026-382; no public exploit or CISA KEV listing exists at time of analysis, but the attack path (AV:N/AC:L/PR:N/UI:N) requires minimal attacker capability.
Unauthenticated remote exploitation of Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) - exposes a critical function with no authentication gate, allowing a network-adjacent or internet-facing attacker to trigger high-availability-impact operations without any credentials. Dell's advisory DSA-2026-382 classifies this under CWE-306 (Missing Authentication for Critical Function), indicating the affected endpoint simply lacks access control rather than having a bypassable one. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the fully unauthenticated network vector with low complexity represents a credible operational risk for any exposed SCG deployment.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to bypass TLS protection mechanisms, enabling man-in-the-middle interception or modification of communications to and from the gateway. Both the Appliance form factor (versions prior to 5.36.00.16) and Application form factor (versions prior to 5.36.00.00) are confirmed affected by Dell advisory DSA-2026-382. No public exploit code exists and EPSS scoring of 0.14% (4th percentile) reflects very low current exploitation probability, consistent with SSVC's 'none' exploitation status.
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse directory boundaries and achieve remote code execution on affected systems. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and Dell has issued a patch under advisory DSA-2026-382.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly validate TLS certificates (CWE-295), affecting the Appliance edition before 5.36.00.16 and the Application edition before 5.36.00.00. An unauthenticated network attacker able to intercept or interpose on connections can defeat the trust chain and gain access to protected resources or data. A vendor patch is available (DSA-2026-382); no public exploit identified at time of analysis and EPSS is low (0.15%).
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE-306), enabling an unauthenticated remote attacker to achieve full confidentiality, integrity, and availability compromise against affected deployments. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed vulnerable per Dell advisory DSA-2026-382 and EUVD-2026-72375. No public exploit has been identified at time of analysis; Dell has released patches for both deployment forms.
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthenticated remote attackers to a full-compromise pathway culminating in remote code execution. Both hardware appliance deployments (prior to 5.36.00.16) and software/virtual application deployments (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis; EPSS exploitation probability stands at 0.53%, and SSVC classifies exploitation status as none.
Hard-coded credentials embedded in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote compromise. A network-accessible attacker who discovers or obtains the static credentials can authenticate without any supplied privileges and gain unauthorized access with high confidentiality and integrity impact. No public exploit or active CISA KEV listing has been identified at time of analysis; Dell has confirmed the vulnerability and released fixed versions via advisory DSA-2026-382.
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated OS command injection in Dell Secure Connect Gateway (SCG) 5.0 Application (versions prior to 5.36.00.00) exposes affected systems to remote code execution by any network-reachable attacker. The flaw (CWE-78) allows injection of shell metacharacters through an unspecified application input that is passed unsanitized to a system call, enabling arbitrary command execution on the gateway host. Dell has released version 5.36.00.00 via advisory DSA-2026-382; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. No public exploit or CISA KEV listing exists at time of analysis.
Dell PowerStore SDNAS (software-defined NAS) on PowerStoreOS builds earlier than 4.3.1.2-2771239 exposes a critical function that performs no authentication check, so an unauthenticated remote attacker who can reach the array's NAS service can gain full filesystem access - reading, modifying, or destroying stored data with no credentials and no user interaction (CVSS 3.1 base 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Realistic exploitation is bounded by network position: PowerStore is a datacenter storage appliance whose NAS and management interfaces are normally segmented and not internet-facing, so an attacker would generally need pre-existing access to the storage or management network segment that can reach SDNAS. No public exploit code has been identified, CISA SSVC rates exploitation as 'none', EPSS is 0.27% (20th percentile), and a vendor patch (PowerStoreOS 4.3.1.2-2771239 or later) is already available per Dell advisory DSA-2026-330.
OS command injection in Dell PowerStore allows a locally authenticated user with limited privileges to execute arbitrary commands with root privileges, achieving full appliance compromise. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) confirms low-complexity local privilege escalation with scope change to root, covering complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full impact triad make this a meaningful risk for environments where multiple accounts share local PowerStore access.
Elevation of privilege in Dell PowerStore storage appliances allows a remote, low-privileged attacker to bypass authorization controls and gain high-level access to the management plane. Affecting at least ten PowerStore hardware models across the T-series and Q-series lines, the flaw stems from incorrect authorization checks (CWE-863) - the system fails to enforce role boundaries on certain operations, allowing a low-privileged session to invoke privileged actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 8.8 score and full C/I/A impact make this a high-priority remediation item for any enterprise running PowerStore.
Command injection in Dell PowerStore storage appliances allows an authenticated low-privileged local user to execute arbitrary operating system commands with root privileges, achieving full appliance compromise. The CVSS scope-change metric (S:C) reflects that root access on a storage platform threatens all data hosted on the array, extending blast radius beyond the appliance itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity once local access is established makes this a priority remediation for organizations running affected PowerStore T and Q series hardware.
Privilege escalation to root on Dell PowerStore storage appliances allows an authenticated user with limited privileges to execute arbitrary code at the operating system's highest privilege level. Affecting the full PowerStore T and Q product families (500T through 7000T confirmed via CPE), this CWE-829 flaw exploits the inclusion of functionality from an untrusted control sphere - meaning a low-privileged local user can influence a privileged execution path by supplying or manipulating untrusted code or configuration loaded by a higher-privileged process. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Dell PowerStore enterprise storage appliances allows authenticated low-privileged users to bypass the platform's access control enforcement and gain elevated system privileges. Classified as CWE-693 (Protection Mechanism Failure), the flaw resides in the protection layer governing role-based access within the PowerStore management stack, spanning at least ten appliance models from the 500T to the 7000T series. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, though network access with valid limited-privilege credentials is required; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell PowerStore storage appliances enables a locally authenticated user with limited privileges to execute arbitrary commands at the root level, achieving full privilege escalation on the appliance. The CVSS scope change (S:C) reflects that root access on a storage platform extends impact beyond the immediate process boundary to the entire appliance and potentially dependent workloads. Dell has published advisory DSA-2026-330, but no specific patched version was provided in available data. No public exploit identified at time of analysis.
Privilege escalation in Dell PowerStore storage appliances allows any authenticated low-privilege user to bypass access restriction controls and gain elevated system privileges, classified under CWE-693 (Protection Mechanism Failure). The entire PowerStore T-series and Q-series lineup is affected, with a network-accessible, low-complexity attack path requiring only a valid account. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score and broad appliance coverage make this a material risk in enterprise storage environments.
Code injection in Dell PowerStore storage appliances (500T through 7000T series and potentially additional models) allows an authenticated user with limited privileges to execute arbitrary code at root privilege level, achieving full appliance compromise. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms that exploitation requires only local authenticated access with low-level credentials and no user interaction, with the resulting code execution crossing a privilege boundary into a root context. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file write in Dell PowerStore allows authenticated low-privileged users to write attacker-controlled content to arbitrary filesystem paths via a Protection Mechanism Failure (CWE-693). Exploitation requires only network access and limited credentials, making this a credible lateral movement or privilege escalation vector within storage environments. No public exploit code has been identified at time of analysis, but the low complexity and low privilege bar make this a realistic threat against enterprise storage infrastructure.
Privilege escalation to Administrator level is possible on Dell PowerStore storage appliances through an authentication bypass by spoofing vulnerability (CWE-290). Any attacker holding a low-privileged account on the PowerStore management plane can exploit this network-accessible flaw without user interaction to gain full administrative control, impacting confidentiality, integrity, and availability of the storage system. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the impact of Administrator-level compromise on enterprise storage infrastructure elevates operational risk considerably.
Privilege escalation in Dell PowerStore storage appliances allows an authenticated low-privilege user to invoke administrator-only management operations via the network, resulting in full confidentiality, integrity, and availability compromise of the storage system. The flaw stems from incorrect authorization checks (CWE-863), where the system fails to enforce proper privilege boundaries on API or management interface operations. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and high-impact CVSS 8.8 rating make this a credible threat in multi-tenant or shared-access storage environments.
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Improper authentication in Dell PowerProtect Cyber Recovery (versions prior to 20.3) allows a remote low-privileged attacker to bypass authorization controls and gain unauthorized access to the backup and recovery environment. The CVSS 8.8 High score reflects network-accessible exploitation with low attack complexity (AV:N/AC:L/PR:L), and full confidentiality, integrity, and availability impact - suggesting the attacker can read, modify, or destroy vaulted backup data. Vendor patch version 20.3.0.0 is available via Dell Security Advisory DSA-2026-370; no active exploitation has been confirmed in CISA KEV and EPSS indicates low current exploitation probability.
OS command injection in Dell PowerProtect One versions 20.1.0.0 and below allows remote code execution by low-privileged authenticated users. The CWE-78 root cause indicates that user-controlled input is passed unsanitized to OS-level shell commands exposed through a network-accessible interface. Dell confirmed this in advisory DSA-2026-369; no public exploit or CISA KEV listing has been identified at time of analysis, though the full C:H/I:H/A:H impact profile makes this a high priority for any organization running this data protection platform.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
OS Command Injection in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to execute arbitrary operating system commands on the underlying host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a valid low-privileged credential, with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.
OS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote user smuggle special shell characters into a command the product executes on the underlying host, resulting in arbitrary command execution. Dell rates it CVSS 9.1 with a scope change, meaning the injected commands can escape the application's authorization boundary onto the host OS. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so severity is driven by impact rather than confirmed activity.
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to bypass access restrictions and gain unauthorized access to protected resources on the affected thin client system. The CVSS score of 7.8 (High) reflects complete confidentiality, integrity, and availability impact upon successful exploitation, despite requiring only local, low-privilege access with low attack complexity. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local attacker through a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires only a local low-privileged account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a remediated version (5.7.1) per advisory DSA-2026-309.
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions prior to 5.7.1, allowing a low-privileged authenticated user to gain unauthorized read and write access to filesystem resources owned or managed by DCU. The flaw stems from overly permissive ACLs set during installation, consistent with CWE-276, and carries a CVSS 7.8 High rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated system access by exploiting missing authorization checks. The vulnerability carries a CVSS 3.1 score of 8.8 with a scope change (S:C), indicating the privilege escalation extends beyond the DCU process itself - likely to OS-level or other system components. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction make this straightforward to exploit for any user with a local account.
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke protected application functions without adequate authorization checks, yielding full confidentiality, integrity, and availability impact on the vulnerable system. Rooted in CWE-862, the flaw bypasses expected access controls within the DCU client utility - a driver and firmware management tool deployed across Dell client hardware fleets. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged attacker exploiting a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The vulnerability allows an attacker who already has a local foothold on the system to manipulate a resource between the time it is checked and the time it is used by the update utility, resulting in full system compromise (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 on local systems. A low-privileged local attacker can exploit unsafe deserialization to execute arbitrary code at a higher privilege level, potentially gaining full system control. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score and straightforward attack complexity make this a meaningful patching priority for enterprise fleets.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to fully compromise system confidentiality, integrity, and availability through unsafe deserialization of attacker-controlled data. The root cause is CWE-502 (Deserialization of Untrusted Data), a class of vulnerability where malicious serialized objects can trigger unintended code paths during deserialization, resulting in privilege escalation on Dell client endpoints. Dell has released version 5.7.1 as a fix per advisory DSA-2026-309; no public exploit or active exploitation has been identified at time of analysis.
OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability stems from improper neutralization of special elements passed to OS commands (CWE-78), resulting in full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the vendor self-disclosed this via Dell Security Advisory DSA-2026-096, indicating a confirmed code-level flaw.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Elevation of privileges in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 allows a low-privileged local user to gain higher system access by exploiting a Least Privilege Violation (CWE-272). The application operates with or invokes components carrying excessive privileges, which a local attacker can abuse through an interaction-dependent trigger to achieve full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full C:H/I:H/A:H triad indicates complete system compromise potential if the privilege boundary is crossed successfully.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a mapped host connected to the array to read from or write to LUNs beyond those assigned to that initiator, effectively nullifying per-initiator LUN masking. Affected models span the full PowerStore T and Q product lines (500T through 7000T and beyond), as disclosed by Dell under advisory DSA-2026-330. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact triplet reflects the severity of unrestricted storage access, particularly in multi-tenant or converged infrastructure environments where multiple workloads share the same array.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Privilege escalation in Dell Watchdog Timer Driver versions prior to 2.0.0.1 allows a local low-privileged attacker to gain full system control by abusing an improperly access-controlled IOCTL interface exposed by the kernel driver. The CVSS scope-changed score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) reflects that exploitation crosses the kernel trust boundary, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a meaningful local privilege escalation risk on Dell-equipped systems.
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attacker to gain elevated system control by exploiting incorrectly set default permissions on files or resources managed by the WMS platform (CWE-269). The CVSS vector confirms a scope change (S:C) with full confidentiality, integrity, and availability impact, meaning a successful exploit transcends the initially compromised process context. Dell has released a fix in version 2605.0.2 via advisory DSA-2026-329; no public exploit code has been identified at time of analysis.
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted file upload vulnerability (CWE-434). A high-privileged remote attacker can upload a file with a dangerous type - such as a web shell or server-side script - to the WMS server, resulting in full code execution with the application's privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and direct RCE impact make patching a priority for organizations running WMS.
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.