Dell
Monthly
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables a locally authenticated low-privileged user to read sensitive data they are not authorized to access. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, as confirmed in Dell advisory DSA-2026-382. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact from a CWE-732 flaw in a remote-support gateway warrants prioritized patching for insider-threat scenarios.
OS Command Injection (CWE-78) in Dell Secure Connect Gateway 5.0 permits low-privileged remote attackers to execute arbitrary operating system commands against both the Appliance and Application deployment variants. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00; Dell has released fixes under advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 enable remote attackers to bypass authentication and access protected system functions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed affected per Dell advisory DSA-2026-382. Exploitation exposes sensitive information with high confidentiality impact, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Remote unauthenticated denial-of-service in Dell Secure Connect Gateway (SCG) 5.0 allows network-adjacent attackers to crash or disable the gateway's protection mechanisms by sending crafted input that triggers an unhandled exceptional condition (CWE-703). Both the physical Appliance variant (prior to 5.36.00.16) and the virtual Application variant (prior to 5.36.00.00) are affected. The primary impact is loss of availability of the SCG service, meaning the gateway's security inspection or remote-support connectivity function is disrupted; no public exploit or active exploitation has been identified at time of analysis.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remote authenticated administrator to execute arbitrary OS commands on the underlying network operating system. Classified under CWE-77, the flaw requires high privilege and high attack complexity, yielding a vendor-assigned CVSS score of 5.0 - reflecting a substantially elevated bar for exploitation compared to typical network-reachable command injection. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a patched version.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-privileged attacker to execute arbitrary OS commands via the network-accessible management interface. Dell disclosed and patched the issue through advisory DSA-2026-322, with version 10.5.6.14 as the confirmed fix. No public exploit code or active exploitation has been identified; the high-privilege and high-complexity prerequisites substantially constrain the realistic threat surface.
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in the REST API of Dell PowerProtect Data Manager versions 20.2.0.0 and below allows a low-privileged authenticated remote attacker to bypass protection mechanisms and perform integrity-impacting actions beyond their authorized scope. The CVSS vector (PR:L, I:H, C:N, A:N) confirms the impact is confined to unauthorized modification of data or configuration - there is no confidentiality or availability exposure. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.
Argument Injection in Dell PowerStore storage appliances allows an authenticated low-privileged user to extract sensitive system information over the network without requiring additional interaction. The vulnerability (CWE-88) arises from improper neutralization of user-controlled input passed as arguments to an internal process, enabling privilege escalation of read access beyond what the account's role should permit. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider and compromised-credential threat.
SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and low privilege bar make this a meaningful risk for environments running affected versions.
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to manipulate user-controlled keys and bypass object-level authorization checks, resulting in unauthorized data tampering. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where the application trusts client-supplied identifiers without server-side authorization validation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an insufficiently trustworthy component (CWE-1357), allowing a remote unauthenticated attacker to inject malicious data into the system cache when user interaction occurs. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 5.3 Medium, with high attack complexity and mandatory user interaction substantially constraining real-world exploitability despite the network-accessible entry point. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating no confirmed active exploitation.
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Improper access control in Dell iDRAC9 allows an unauthenticated remote attacker to access unauthorized data under high-complexity conditions. Affected generations are 14G firmware prior to 7.00.00.182 and 15G/16G firmware prior to 7.20.30.50. No public exploit code or CISA KEV listing has been identified at time of analysis, but iDRAC exposure on management networks represents a significant attack surface in enterprise environments.
Arbitrary file write in Dell Client BIOS affects multiple Alienware, Inspiron, and XPS systems through a link-following flaw (CWE-379) exploitable by a low-privileged local attacker. The vulnerability allows the BIOS update or management process to follow attacker-planted symlinks in temporary directories, redirecting privileged file writes to arbitrary filesystem locations - enabling integrity compromise or availability impact at the OS level. No public exploit identified at time of analysis and no CISA KEV listing; however, patch versions are confirmed via Dell advisory DSA-2026-280.
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated permissions through an Incorrect Authorization flaw (CWE-863). The vulnerability does not require user interaction or special configuration beyond the presence of a low-privileged local account on a Dell system running a vulnerable DCU version. Dell has released a fix in version 5.7.1 via advisory DSA-2026-309, and no public exploit has been identified at time of analysis.
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, confirmed via Dell Security Advisory DSA-2026-309. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H) indicates that a standard local account with no elevated rights and no user interaction is sufficient to trigger high-confidentiality-impact disclosure - potentially exposing hardware identifiers, system configuration details, or other privileged data handled by the update utility. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker to elevate their access by exploiting improper symbolic or hard link resolution (CWE-59) during DCU's file operations. Because DCU routinely executes with elevated system privileges to install drivers and firmware, an attacker who can plant a crafted link at a path DCU resolves can redirect those privileged file operations to arbitrary protected locations, achieving integrity impact rated High. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; Dell has released a fix in version 5.7.1 via advisory DSA-2026-309.
Elevation of privilege in Dell PowerPath for Windows (versions 7.2 through 8.0 SP1) allows a low-privileged local attacker to gain elevated system privileges through improper privilege management (CWE-269). Dell has published security advisory DSA-2026-167 confirming the flaw and releasing a fix; the CVSS 3.1 base score is 5.3 (Medium), reflecting the local-only attack vector and limited scope. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
Privilege escalation and denial of service in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 are achievable by a local low-privileged attacker exploiting a link-following flaw in the application's privileged file access routines. The vulnerability allows an attacker to substitute a symbolic link or directory junction between the time AWCC resolves a filesystem path and the time it performs a privileged file operation, redirecting that operation to an arbitrary location. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; Dell has released a patched version per advisory DSA-2026-334.
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools component, enabling information disclosure to locally authenticated low-privileged users. A local attacker with minimal privileges can read svc_tools log files to extract sensitive data - potentially credentials, tokens, or internal configuration secrets - without requiring elevated permissions. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) indicates the logged data is meaningfully sensitive.
Path traversal in Dell ObjectScale before version 4.3.0.1 enables a local, low-privileged attacker to read files outside the intended directory scope, resulting in partial information disclosure. The CVSS 3.3 (Low) score reflects the constrained attack surface - local authenticated access and an existing low-privileged account are prerequisites, and impact is limited to confidentiality with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Dell iDRAC9 (prior to 7.20.30.50) and iDRAC10 (prior to 1.20.60.50) expose residual memory contents to low-privileged remote attackers due to improper memory sanitization classified under CWE-1330 (Remanent Data Readable after Memory Erase). Exploitation requires authenticated low-privilege access and user interaction, yielding limited confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis, and Dell has released patched firmware versions per advisory DSA-2026-348.
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows network-accessible attackers to access sensitive data through a critical management function lacking authentication enforcement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special configuration - any reachable WMS instance running an unpatched version is a valid target. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis; a vendor-released patch is available.
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to any low-privileged local user who discovers them. Exploitation yields high confidentiality and integrity impact - an attacker can read sensitive management data and alter system state - while availability is unaffected. No public exploit code or CISA KEV listing exists at time of analysis, but the CWE-798 class is historically trivial to exploit once credentials are extracted from binaries or configuration files.
Relative path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.2 enables low-privileged remote attackers to read arbitrary files from the underlying server filesystem. The flaw (CWE-23) affects managed node components across Windows, RHEL 8.10, RHEL 9.4, and SLES 15 deployments, as confirmed by Dell advisory DSA-2026-326. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact in a privileged server management context elevates practical risk beyond the moderate CVSS base score alone.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with physical device access to bypass encryption controls and gain unauthorized read and write access to data stored on the thin client. The flaw, classified as CWE-693, indicates the encryption or authentication protection subsystem can be circumvented without any credentials, consistent with the Authentication Bypass tag and CVSS PR:N rating. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the physical access constraint limits but does not eliminate risk in environments with unattended or theft-prone thin clients.
Local information disclosure in Dell PowerScale OneFS (9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2) arises from sensitive data being written to log files, allowing a low-privileged local user to read secrets they should not access. Dell reported the issue (advisory DSA-2026-261) with no public exploit identified at time of analysis. Exploitation requires existing local, authenticated access to the cluster, limiting reach to insiders or attackers who have already established a foothold.
Elevation of privileges in Dell PowerScale OneFS versions 9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2 allows a high-privileged local attacker to escalate beyond their authorized access level due to improper privilege management (CWE-269). While the CVSS 3.1 base score of 6.7 reflects the local access and high-privilege prerequisites that constrain exploitability, the full C:H/I:H/A:H impact triad signals complete system compromise upon successful exploitation - a serious outcome for enterprise NAS infrastructure that frequently stores sensitive organizational data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged attacker via an XML External Entity (XXE) injection flaw (CWE-611). By submitting crafted XML containing external entity declarations to a vulnerable parsing endpoint, an authenticated attacker can cause the server to read and return sensitive local files or initiate server-side requests, resulting in High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Dell has issued advisory DSA-2026-272 covering this and related vulnerabilities across the PowerMax product family.
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to remote attackers holding low-privileged credentials. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequence, consistent with a read-only directory traversal flaw. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the low attack complexity raises concern for rapid weaponization if credentials are compromised.
Unauthorized file modification in Dell PowerProtect Data Domain allows a high-privileged remote attacker to write files outside the intended restricted directory via path traversal. Affected across multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 branches. Dell has published advisory DSA-2026-278 addressing this flaw; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell PowerProtect Data Domain across four supported release tracks allows a high-privileged local attacker to execute arbitrary operating system commands. Affected versions span the main release line (7.7.1.0-8.7) as well as LTS2024, LTS2025, and LTS2026 branch releases. No public exploit code or active exploitation has been identified at time of analysis; the local access and high-privilege prerequisites substantially constrain the realistic attack surface despite the full C/I/A impact scores.
Integer overflow in Dell PowerProtect Data Domain across multiple release trains (main, LTS2024, LTS2025, LTS2026) exposes backup and data protection infrastructure to remote denial of service by an unauthenticated attacker. The CVSS vector (AV:N/AC:H/PR:N) confirms network-accessible, unauthenticated exploitation, though high attack complexity constrains practical exploitation to adversaries who can satisfy specific preconditions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Symlink-following vulnerability in Dell PowerProtect Data Domain allows a high-privileged remote attacker to traverse outside intended file paths and read arbitrary files, resulting in information disclosure. Multiple version branches are affected, including the current mainstream 8.7 release, LTS2026 builds through 8.6.1.10, LTS2025 builds through 8.3.1.30, and LTS2024 builds through 7.13.1.70. Dell published advisory DSA-2026-278 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
Information exposure in Dell PowerProtect Data Domain across multiple release tracks allows a low-privileged local attacker to read sensitive residual data via an uninitialized memory resource (CWE-908). The flaw spans the mainline 7.7.1.0-8.7 branch and three LTS tracks (LTS2024, LTS2025, LTS2026), confirmed by Dell via advisory DSA-2026-278. No public exploit code exists and no active exploitation has been identified; the CVSS 3.3 score and local-only attack vector place this firmly in the low-severity tier.
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary operating system commands on the backup appliance, achieving full command execution within the Data Domain OS (DDOS). The flaw spans the general release track (7.7.1.0-8.6) and three LTS streams (LTS2024, LTS2025, LTS2026), indicating a shared vulnerable code path across a wide version surface. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H/AV:L prerequisites meaningfully constrain real-world risk to insider threats or post-compromise scenarios.
Incorrect authorization in Dell PowerProtect Data Domain permits a high-privileged local attacker to execute commands outside their authorized scope across a broad span of affected versions covering the main release line and all three active LTS branches. The root cause (CWE-863) indicates the appliance's Data Domain OS fails to enforce authorization boundaries correctly for certain operations accessible to already-elevated users, enabling privilege escalation within an authenticated administrative session. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.2 Medium score accurately reflects the significant access prerequisites - local presence plus high-level credentials - required to trigger the flaw.
Dell PowerProtect Data Domain exposes sensitive file content to high-privileged local attackers through a symlink-following flaw (CWE-59), where the application fails to validate link targets before file access. Affected versions span multiple release trains including the current 8.x mainline and LTS branches. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in Dell PowerProtect Data Domain exposes credentials or configuration data to local low-privileged attackers via insufficiently protected log files. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, with specific LTS branches also impacted. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) warrants prompt patching on any appliance accessible to untrusted local users or shared administrative accounts.
Improper access control in the RBAC implementation of Dell PowerProtect Data Domain allows a low-privileged authenticated remote attacker to tamper with information beyond their authorized role scope. Affected releases span the main 7.7.1.0-8.6 line and three LTS tracks covering LTS2024, LTS2025, and LTS2026. No public exploit code has been identified and exploitation has not been confirmed by CISA KEV, placing this as a medium-priority issue requiring patch scheduling rather than emergency response.
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote attacker to execute arbitrary operating system commands on the appliance. Affected products span mainline versions 7.7.1.0 through 8.7 and three LTS branches, confirmed by Dell Security Advisory DSA-2026-278. No public exploit identified at time of analysis and the CVE is absent from CISA KEV; however, the high integrity and availability impact (I:H/A:H) on a backup appliance makes patching urgent for environments where backup infrastructure is shared or admin credentials are broadly distributed.
Format string exploitation in Dell PowerProtect Data Domain enables remote high-privileged attackers to disclose memory contents and crash the service across multiple concurrent release trains. Affected versions span the mainline (7.7.1.0-8.7), LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70) branches, creating broad organizational exposure for enterprises running any supported Data Domain release. No public exploit or confirmed active exploitation has been identified at time of analysis; the mandatory high-privilege prerequisite substantially constrains the realistic attacker pool.
Dell PowerProtect Data Domain's handling of a less-trusted data source allows a remote, high-privileged attacker to perform limited information tampering, classified under CWE-348. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 long-term support branches. With a CVSS base score of 2.7 (Low) and no confirmed active exploitation or public proof-of-concept, real-world impact is constrained by the high privilege requirement and the limited integrity-only scope of the vulnerability.
Path traversal in Dell PowerProtect Data Domain allows a locally authenticated high-privileged attacker to read files outside restricted directories, resulting in information disclosure. Affected deployments span multiple release trains - standard releases 7.7.1.0 through 8.6, LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, and LTS2024 7.13.1.0-7.13.1.70. No public exploit identified at time of analysis; the low CVSS score of 2.3 correctly reflects the high privilege and local access prerequisites that substantially constrain real-world exploitation scope.
Incorrect permission assignment on a critical resource in Dell PowerProtect Data Domain exposes sensitive data to high-privileged local attackers across a broad range of supported release trains. The flaw (CWE-732) means a resource - likely a file, directory, or configuration object - carries overly permissive access controls, allowing a local attacker operating with elevated privileges to read data they are not authorized to access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the breadth of affected versions (seven release trains spanning 2024-2026 LTS and mainline builds) increases aggregate exposure across enterprise backup environments.
Link-following exploitation in Dell PowerProtect Data Domain enables a high-privileged local attacker to read files outside their intended access scope by manipulating symbolic or hard links before file access operations resolve. Affected across multiple release trains - mainline 7.7.1.0 through 8.6, LTS2026 8.6.1.10 and below, LTS2025 8.3.1.30 and below, and LTS2024 7.13.1.70 and below. No public exploit code or active exploitation confirmed at time of analysis; risk is bounded by the requirement for pre-existing high-privilege local access.
Physical-access authentication bypass in Dell Client Platform BIOS (CWE-305) affects a sweeping range of Dell consumer, gaming, and enterprise platforms - including Inspiron, Alienware, Latitude, OptiPlex, and Precision lines. An unauthenticated attacker with physical access and the ability to meet high-complexity attack conditions can bypass the primary BIOS authentication mechanism, resulting in information disclosure and, per the CVSS integrity metric (I:H), potential high-integrity impact. Notably, the declared impact in the description is limited to 'Information Disclosure' while the supplied CVSS vector assigns I:H, a discrepancy that warrants clarification from Dell's advisory DSA-2026-195. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local attacker to authenticate using those credentials and access sensitive information. Reported by Dell under DSA-2026-247, the flaw is classified under CWE-1392 (Use of Default Credentials) and carries a CVSS 3.1 base score of 6.0, reflecting local-only attack surface constrained by the requirement for high privilege. No public exploit code or CISA KEV listing has been identified at time of analysis.
Host Header Injection in Dell PowerFlex Rack RCM 3.7 enables unauthenticated remote attackers to trigger open redirects by supplying a forged HTTP Host header, potentially redirecting victim users to attacker-controlled sites for phishing or credential harvesting. The CVSS 4.3 Medium score reflects the requirement for user interaction (UI:R) and limited confidentiality impact, with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and the vulnerability has no CISA KEV listing.
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insufficiently sanitized SQL command input. The vulnerability requires both network adjacency and existing low-level credentials, limiting its reach considerably from an opportunistic threat standpoint. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis; the CVSS score of 3.5 (Low) reflects the constrained attack surface.
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial of service condition against the management platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable with minimal complexity once credentials are obtained, and is limited in scope to availability degradation (A:L). No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure management communications to potential interception and modification. Remote unauthenticated attackers who achieve the requisite network positioning - consistent with the CVSS AC:H rating - could exploit weak or deprecated cryptographic primitives to partially disclose sensitive management data (C:L) or tamper with communications in transit (I:L). Dell has published advisory DSA-2026-066 under the multi-CVE release DSA-2026-066; no public exploit code and no active exploitation (CISA KEV absent) have been identified at time of analysis.
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
update_disk_psu_baseline.sh requires password in plain text. Rated high severity (CVSS 7.4).
api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions. Rated high severity (CVSS 7.0). This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. Rated medium severity (CVSS 6.7).
Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. Rated medium severity (CVSS 6.7).
Weak password encoding in Dell Client Platform BIOS (CWE-261) exposes BIOS credentials to recovery by a physically present unauthenticated attacker, enabling privilege escalation through unauthorized BIOS access. Affected hardware spans ruggedized Latitude field devices, Precision workstation towers and racks, and Edge/Embedded Gateway platforms - product categories frequently deployed in physically accessible or unattended environments. No public exploit code exists and no active exploitation has been identified at time of analysis, but the combination of credential recoverability and high-confidentiality/high-integrity CVSS impact makes patching a priority for organizations managing assets in low-physical-security locations.
Arbitrary file write in Dell/Alienware Purchased Apps versions prior to 1.1.32.0 is achievable by a low-privileged local attacker through a link-following (CWE-59) flaw, enabling overwrite of files at elevated privilege levels and resulting in high integrity and availability impact. The CVSS vector (AV:L/AC:H/PR:L) confirms local access with high attack complexity is required, suggesting exploitation likely involves a race condition or carefully staged symlink placement. No active exploitation is confirmed (not in CISA KEV), and a vendor-released patch is available at version 1.1.32.0.
Arbitrary file write in Dell Inventory Collector Client versions prior to 13.8.0 allows a low-privileged local attacker to overwrite files outside the intended write path by exploiting improper symbolic or hard link resolution. The vulnerability (CWE-1386) arises when the client resolves a link to an unintended target before performing a file access operation, enabling an attacker to redirect writes to attacker-controlled locations. No public exploit has been identified at time of analysis and CISA KEV confirmation is absent, but the high integrity and availability impact (CVSS I:H/A:H) means successful exploitation could corrupt system files or cause denial of service.
Link-following (symlink attack) in Dell iDRAC Tools versions prior to 11.4.1.0 allows a low-privileged local attacker to redirect file operations to unintended targets, resulting in unauthorized modification of files (high integrity impact) and potential availability disruption. Exploitation requires both low-level local access and user interaction, placing this in a constrained attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and no EPSS score was supplied in source data.
Denial of service in Dell BSAFE SSL-J allows unauthenticated remote attackers to exhaust resources on systems using the cryptographic library, rendering affected services unavailable. The flaw stems from CWE-770 (allocation of resources without limits or throttling) and carries a CVSS 7.5 score reflecting network-reachable, no-privilege exploitation with high availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated attacker to bypass access controls, exposing sensitive information with high confidentiality and integrity impact. The flaw, rooted in CWE-284 (Improper Access Control), enables circumvention of authentication or authorization mechanisms at the device level without requiring prior credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit has been identified; Dell has released a patched build addressing this issue.
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual Appliance) lets remote, unauthenticated attackers bypass access controls and perform actions or modify data they should not be permitted to reach. The CVSS 3.1 vector (C:N/I:H/A:N) scopes the impact to integrity - unauthorized state or data changes - rather than data disclosure or denial of service. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Broken access control in the Identity and Access Management (IAM) module of Dell ECS (Elastic Cloud Storage) 3.5 and 3.6 lets a remote, unauthenticated attacker read data they should not be able to reach. The flaw exposes confidential object/storage data without granting write or availability impact, and it is fixed in maintenance releases 3.5.1.7 and 3.6.2.4. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-privileged local users, resulting in unauthorized disclosure of confidential data with high confidentiality impact per CVSS. Affected deployments span both the Appliance and Rack form factors of the platform. No public exploit code has been identified at time of analysis and CISA KEV does not list this vulnerability, though the CWE-922 root cause and the 'Authentication Bypass' tag suggest the exposed data may include credentials or tokens that could enable downstream privilege escalation or lateral movement.
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager's SSH component (versions ≤4.6.2) allows a locally authenticated low-privileged attacker to bypass SSH protection mechanisms, affecting both Appliance and Rack form factors. The CVSS vector (AV:L/AC:H/PR:L) reflects significant exploitation barriers: physical or logical local access is required, attack complexity is high, and impact is limited to partial confidentiality and integrity loss with no availability impact. Dell has published dual advisories (DSA-2025-434 for Appliance, DSA-2025-435 for Rack); no public exploit or CISA KEV listing exists at time of analysis.
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link that, once clicked by a targeted user, silently forwards them from the trusted PowerFlex Manager domain to an attacker-controlled URL. Because the redirect abuses the credibility of the management interface, it is primarily a phishing and credential-harvesting enabler rather than a direct server compromise. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker on an adjacent network to intercept and tamper with protected communications. The flaw (CWE-295) means the product fails to adequately verify peer certificates during TLS/SSL exchanges, enabling a man-in-the-middle position to read or modify in-transit management data. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentials, keys, or configuration secrets to any attacker with local OS-level access to the appliance - no PowerFlex Manager authentication required. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs only local system access, not application credentials, to retrieve the improperly protected data. No public exploit identified at time of analysis and no CISA KEV listing; however, the 'Authentication Bypass' tag in the intelligence data suggests the exposed sensitive material may itself enable downstream privilege escalation or authentication bypass against PowerFlex or its managed infrastructure.
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a local, low-privileged user to gain higher privileges through an Incorrect Privilege Assignment (CWE-266) flaw. An attacker who already has a foothold on the management host can abuse mis-scoped privileges to achieve full confidentiality, integrity, and availability impact on the system. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated remote attackers to read directory listings served by the management interface, exposing file and path names that can reveal sensitive configuration and system details. The flaw is remotely reachable without credentials or user interaction (CVSS 7.5), but there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02%. CISA's SSVC framework rates exploitation as 'none' and technical impact as 'partial,' indicating a genuine but non-critical disclosure issue rather than a code-execution threat.
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows unauthenticated remote attackers to enumerate server contents through exposed directory listings. The flaw carries a CVSS 7.5 (high) rating driven entirely by confidentiality impact and requires no privileges or user interaction, though no public exploit identified at time of analysis and the issue is not on CISA KEV.
Command injection in Dell SmartFabric Storage Software versions prior to 1.4.5 enables a high-privileged local attacker to gain unauthorized read and write access to the underlying filesystem. Exploitation requires local system presence and high-level privileges, with the CVSS vector (AV:L/AC:H/PR:H) indicating a constrained threat surface despite the high confidentiality, integrity, and availability impact scores. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Symbolic link exploitation in Portrait Dell Color Management (before 3.7.0) on Windows allows a local low-privileged user to escalate privileges to Administrator by redirecting an elevated installer file write to an arbitrary system path. During installation, the software writes CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ with Administrator-level privileges while failing to validate symlinks or reparse points at the destination - an attacker who pre-stages a malicious junction or symlink at that path gains arbitrary file creation or overwrite capability under the elevated context. No public exploit code has been identified at time of analysis; SSVC signals confirm no known active exploitation.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) enables a locally authenticated low-privileged user to read sensitive data they are not authorized to access. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, as confirmed in Dell advisory DSA-2026-382. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality impact from a CWE-732 flaw in a remote-support gateway warrants prioritized patching for insider-threat scenarios.
OS Command Injection (CWE-78) in Dell Secure Connect Gateway 5.0 permits low-privileged remote attackers to execute arbitrary operating system commands against both the Appliance and Application deployment variants. Affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00; Dell has released fixes under advisory DSA-2026-382. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged local attacker to read sensitive data written to application log files without sanitization. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected across all platforms. No public exploit code or active exploitation has been identified; Dell has released fixes via advisory DSA-2026-382.
Hardcoded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - allows a low-privileged local attacker to access protected data encrypted with the embedded key, leading to information disclosure. Affected versions include SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00. Dell has released patched versions via DSA-2026-382; no public exploit or KEV listing has been identified at time of analysis.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 enable remote attackers to bypass authentication and access protected system functions. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are confirmed affected per Dell advisory DSA-2026-382. Exploitation exposes sensitive information with high confidentiality impact, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to decrypt data that was intended to be cryptographically protected, resulting in high-severity information disclosure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches via advisory DSA-2026-382.
Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Remote unauthenticated denial-of-service in Dell Secure Connect Gateway (SCG) 5.0 allows network-adjacent attackers to crash or disable the gateway's protection mechanisms by sending crafted input that triggers an unhandled exceptional condition (CWE-703). Both the physical Appliance variant (prior to 5.36.00.16) and the virtual Application variant (prior to 5.36.00.00) are affected. The primary impact is loss of availability of the SCG service, meaning the gateway's security inspection or remote-support connectivity function is disrupted; no public exploit or active exploitation has been identified at time of analysis.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remote authenticated administrator to execute arbitrary OS commands on the underlying network operating system. Classified under CWE-77, the flaw requires high privilege and high attack complexity, yielding a vendor-assigned CVSS score of 5.0 - reflecting a substantially elevated bar for exploitation compared to typical network-reachable command injection. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a patched version.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-privileged attacker to execute arbitrary OS commands via the network-accessible management interface. Dell disclosed and patched the issue through advisory DSA-2026-322, with version 10.5.6.14 as the confirmed fix. No public exploit code or active exploitation has been identified; the high-privilege and high-complexity prerequisites substantially constrain the realistic threat surface.
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in the REST API of Dell PowerProtect Data Manager versions 20.2.0.0 and below allows a low-privileged authenticated remote attacker to bypass protection mechanisms and perform integrity-impacting actions beyond their authorized scope. The CVSS vector (PR:L, I:H, C:N, A:N) confirms the impact is confined to unauthorized modification of data or configuration - there is no confidentiality or availability exposure. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.
Argument Injection in Dell PowerStore storage appliances allows an authenticated low-privileged user to extract sensitive system information over the network without requiring additional interaction. The vulnerability (CWE-88) arises from improper neutralization of user-controlled input passed as arguments to an internal process, enabling privilege escalation of read access beyond what the account's role should permit. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider and compromised-credential threat.
SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and low privilege bar make this a meaningful risk for environments running affected versions.
Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to manipulate user-controlled keys and bypass object-level authorization checks, resulting in unauthorized data tampering. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where the application trusts client-supplied identifiers without server-side authorization validation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cache poisoning in Dell PowerProtect One versions 20.1.0.0 and below exposes environments to integrity violations via an insufficiently trustworthy component (CWE-1357), allowing a remote unauthenticated attacker to inject malicious data into the system cache when user interaction occurs. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 5.3 Medium, with high attack complexity and mandatory user interaction substantially constraining real-world exploitability despite the network-accessible entry point. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating no confirmed active exploitation.
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Improper access control in Dell iDRAC9 allows an unauthenticated remote attacker to access unauthorized data under high-complexity conditions. Affected generations are 14G firmware prior to 7.00.00.182 and 15G/16G firmware prior to 7.20.30.50. No public exploit code or CISA KEV listing has been identified at time of analysis, but iDRAC exposure on management networks represents a significant attack surface in enterprise environments.
Arbitrary file write in Dell Client BIOS affects multiple Alienware, Inspiron, and XPS systems through a link-following flaw (CWE-379) exploitable by a low-privileged local attacker. The vulnerability allows the BIOS update or management process to follow attacker-planted symlinks in temporary directories, redirecting privileged file writes to arbitrary filesystem locations - enabling integrity compromise or availability impact at the OS level. No public exploit identified at time of analysis and no CISA KEV listing; however, patch versions are confirmed via Dell advisory DSA-2026-280.
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain elevated permissions through an Incorrect Authorization flaw (CWE-863). The vulnerability does not require user interaction or special configuration beyond the presence of a low-privileged local account on a Dell system running a vulnerable DCU version. Dell has released a fix in version 5.7.1 via advisory DSA-2026-309, and no public exploit has been identified at time of analysis.
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, confirmed via Dell Security Advisory DSA-2026-309. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H) indicates that a standard local account with no elevated rights and no user interaction is sufficient to trigger high-confidentiality-impact disclosure - potentially exposing hardware identifiers, system configuration details, or other privileged data handled by the update utility. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker to elevate their access by exploiting improper symbolic or hard link resolution (CWE-59) during DCU's file operations. Because DCU routinely executes with elevated system privileges to install drivers and firmware, an attacker who can plant a crafted link at a path DCU resolves can redirect those privileged file operations to arbitrary protected locations, achieving integrity impact rated High. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; Dell has released a fix in version 5.7.1 via advisory DSA-2026-309.
Elevation of privilege in Dell PowerPath for Windows (versions 7.2 through 8.0 SP1) allows a low-privileged local attacker to gain elevated system privileges through improper privilege management (CWE-269). Dell has published security advisory DSA-2026-167 confirming the flaw and releasing a fix; the CVSS 3.1 base score is 5.3 (Medium), reflecting the local-only attack vector and limited scope. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
Privilege escalation and denial of service in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 are achievable by a local low-privileged attacker exploiting a link-following flaw in the application's privileged file access routines. The vulnerability allows an attacker to substitute a symbolic link or directory junction between the time AWCC resolves a filesystem path and the time it performs a privileged file operation, redirecting that operation to an arbitrary location. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; Dell has released a patched version per advisory DSA-2026-334.
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools component, enabling information disclosure to locally authenticated low-privileged users. A local attacker with minimal privileges can read svc_tools log files to extract sensitive data - potentially credentials, tokens, or internal configuration secrets - without requiring elevated permissions. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) indicates the logged data is meaningfully sensitive.
Path traversal in Dell ObjectScale before version 4.3.0.1 enables a local, low-privileged attacker to read files outside the intended directory scope, resulting in partial information disclosure. The CVSS 3.3 (Low) score reflects the constrained attack surface - local authenticated access and an existing low-privileged account are prerequisites, and impact is limited to confidentiality with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Dell iDRAC9 (prior to 7.20.30.50) and iDRAC10 (prior to 1.20.60.50) expose residual memory contents to low-privileged remote attackers due to improper memory sanitization classified under CWE-1330 (Remanent Data Readable after Memory Erase). Exploitation requires authenticated low-privilege access and user interaction, yielding limited confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis, and Dell has released patched firmware versions per advisory DSA-2026-348.
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows network-accessible attackers to access sensitive data through a critical management function lacking authentication enforcement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special configuration - any reachable WMS instance running an unpatched version is a valid target. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis; a vendor-released patch is available.
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to any low-privileged local user who discovers them. Exploitation yields high confidentiality and integrity impact - an attacker can read sensitive management data and alter system state - while availability is unaffected. No public exploit code or CISA KEV listing exists at time of analysis, but the CWE-798 class is historically trivial to exploit once credentials are extracted from binaries or configuration files.
Relative path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.2 enables low-privileged remote attackers to read arbitrary files from the underlying server filesystem. The flaw (CWE-23) affects managed node components across Windows, RHEL 8.10, RHEL 9.4, and SLES 15 deployments, as confirmed by Dell advisory DSA-2026-326. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact in a privileged server management context elevates practical risk beyond the moderate CVSS base score alone.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with physical device access to bypass encryption controls and gain unauthorized read and write access to data stored on the thin client. The flaw, classified as CWE-693, indicates the encryption or authentication protection subsystem can be circumvented without any credentials, consistent with the Authentication Bypass tag and CVSS PR:N rating. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the physical access constraint limits but does not eliminate risk in environments with unattended or theft-prone thin clients.
Local information disclosure in Dell PowerScale OneFS (9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2) arises from sensitive data being written to log files, allowing a low-privileged local user to read secrets they should not access. Dell reported the issue (advisory DSA-2026-261) with no public exploit identified at time of analysis. Exploitation requires existing local, authenticated access to the cluster, limiting reach to insiders or attackers who have already established a foothold.
Elevation of privileges in Dell PowerScale OneFS versions 9.5.0.0-9.10.1.7 and 9.11.0.0-9.13.0.2 allows a high-privileged local attacker to escalate beyond their authorized access level due to improper privilege management (CWE-269). While the CVSS 3.1 base score of 6.7 reflects the local access and high-privilege prerequisites that constrain exploitability, the full C:H/I:H/A:H impact triad signals complete system compromise upon successful exploitation - a serious outcome for enterprise NAS infrastructure that frequently stores sensitive organizational data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized file disclosure in Dell Unisphere for PowerMax 10.3.0.5 and prior is achievable by a remote low-privileged attacker via an XML External Entity (XXE) injection flaw (CWE-611). By submitting crafted XML containing external entity declarations to a vulnerable parsing endpoint, an authenticated attacker can cause the server to read and return sensitive local files or initiate server-side requests, resulting in High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Dell has issued advisory DSA-2026-272 covering this and related vulnerabilities across the PowerMax product family.
Path traversal in Dell Unisphere for PowerMax 10.3.0.5 and prior exposes arbitrary files on the underlying server to remote attackers holding low-privileged credentials. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequence, consistent with a read-only directory traversal flaw. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the low attack complexity raises concern for rapid weaponization if credentials are compromised.
Unauthorized file modification in Dell PowerProtect Data Domain allows a high-privileged remote attacker to write files outside the intended restricted directory via path traversal. Affected across multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 branches. Dell has published advisory DSA-2026-278 addressing this flaw; no public exploit code or active exploitation has been identified at time of analysis.
OS command injection in Dell PowerProtect Data Domain across four supported release tracks allows a high-privileged local attacker to execute arbitrary operating system commands. Affected versions span the main release line (7.7.1.0-8.7) as well as LTS2024, LTS2025, and LTS2026 branch releases. No public exploit code or active exploitation has been identified at time of analysis; the local access and high-privilege prerequisites substantially constrain the realistic attack surface despite the full C/I/A impact scores.
Integer overflow in Dell PowerProtect Data Domain across multiple release trains (main, LTS2024, LTS2025, LTS2026) exposes backup and data protection infrastructure to remote denial of service by an unauthenticated attacker. The CVSS vector (AV:N/AC:H/PR:N) confirms network-accessible, unauthenticated exploitation, though high attack complexity constrains practical exploitation to adversaries who can satisfy specific preconditions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Symlink-following vulnerability in Dell PowerProtect Data Domain allows a high-privileged remote attacker to traverse outside intended file paths and read arbitrary files, resulting in information disclosure. Multiple version branches are affected, including the current mainstream 8.7 release, LTS2026 builds through 8.6.1.10, LTS2025 builds through 8.3.1.30, and LTS2024 builds through 7.13.1.70. Dell published advisory DSA-2026-278 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
Information exposure in Dell PowerProtect Data Domain across multiple release tracks allows a low-privileged local attacker to read sensitive residual data via an uninitialized memory resource (CWE-908). The flaw spans the mainline 7.7.1.0-8.7 branch and three LTS tracks (LTS2024, LTS2025, LTS2026), confirmed by Dell via advisory DSA-2026-278. No public exploit code exists and no active exploitation has been identified; the CVSS 3.3 score and local-only attack vector place this firmly in the low-severity tier.
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary operating system commands on the backup appliance, achieving full command execution within the Data Domain OS (DDOS). The flaw spans the general release track (7.7.1.0-8.6) and three LTS streams (LTS2024, LTS2025, LTS2026), indicating a shared vulnerable code path across a wide version surface. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H/AV:L prerequisites meaningfully constrain real-world risk to insider threats or post-compromise scenarios.
Incorrect authorization in Dell PowerProtect Data Domain permits a high-privileged local attacker to execute commands outside their authorized scope across a broad span of affected versions covering the main release line and all three active LTS branches. The root cause (CWE-863) indicates the appliance's Data Domain OS fails to enforce authorization boundaries correctly for certain operations accessible to already-elevated users, enabling privilege escalation within an authenticated administrative session. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.2 Medium score accurately reflects the significant access prerequisites - local presence plus high-level credentials - required to trigger the flaw.
Dell PowerProtect Data Domain exposes sensitive file content to high-privileged local attackers through a symlink-following flaw (CWE-59), where the application fails to validate link targets before file access. Affected versions span multiple release trains including the current 8.x mainline and LTS branches. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in Dell PowerProtect Data Domain exposes credentials or configuration data to local low-privileged attackers via insufficiently protected log files. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, with specific LTS branches also impacted. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact (C:H) warrants prompt patching on any appliance accessible to untrusted local users or shared administrative accounts.
Improper access control in the RBAC implementation of Dell PowerProtect Data Domain allows a low-privileged authenticated remote attacker to tamper with information beyond their authorized role scope. Affected releases span the main 7.7.1.0-8.6 line and three LTS tracks covering LTS2024, LTS2025, and LTS2026. No public exploit code has been identified and exploitation has not been confirmed by CISA KEV, placing this as a medium-priority issue requiring patch scheduling rather than emergency response.
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote attacker to execute arbitrary operating system commands on the appliance. Affected products span mainline versions 7.7.1.0 through 8.7 and three LTS branches, confirmed by Dell Security Advisory DSA-2026-278. No public exploit identified at time of analysis and the CVE is absent from CISA KEV; however, the high integrity and availability impact (I:H/A:H) on a backup appliance makes patching urgent for environments where backup infrastructure is shared or admin credentials are broadly distributed.
Format string exploitation in Dell PowerProtect Data Domain enables remote high-privileged attackers to disclose memory contents and crash the service across multiple concurrent release trains. Affected versions span the mainline (7.7.1.0-8.7), LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70) branches, creating broad organizational exposure for enterprises running any supported Data Domain release. No public exploit or confirmed active exploitation has been identified at time of analysis; the mandatory high-privilege prerequisite substantially constrains the realistic attacker pool.
Dell PowerProtect Data Domain's handling of a less-trusted data source allows a remote, high-privileged attacker to perform limited information tampering, classified under CWE-348. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 long-term support branches. With a CVSS base score of 2.7 (Low) and no confirmed active exploitation or public proof-of-concept, real-world impact is constrained by the high privilege requirement and the limited integrity-only scope of the vulnerability.
Path traversal in Dell PowerProtect Data Domain allows a locally authenticated high-privileged attacker to read files outside restricted directories, resulting in information disclosure. Affected deployments span multiple release trains - standard releases 7.7.1.0 through 8.6, LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, and LTS2024 7.13.1.0-7.13.1.70. No public exploit identified at time of analysis; the low CVSS score of 2.3 correctly reflects the high privilege and local access prerequisites that substantially constrain real-world exploitation scope.
Incorrect permission assignment on a critical resource in Dell PowerProtect Data Domain exposes sensitive data to high-privileged local attackers across a broad range of supported release trains. The flaw (CWE-732) means a resource - likely a file, directory, or configuration object - carries overly permissive access controls, allowing a local attacker operating with elevated privileges to read data they are not authorized to access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the breadth of affected versions (seven release trains spanning 2024-2026 LTS and mainline builds) increases aggregate exposure across enterprise backup environments.
Link-following exploitation in Dell PowerProtect Data Domain enables a high-privileged local attacker to read files outside their intended access scope by manipulating symbolic or hard links before file access operations resolve. Affected across multiple release trains - mainline 7.7.1.0 through 8.6, LTS2026 8.6.1.10 and below, LTS2025 8.3.1.30 and below, and LTS2024 7.13.1.70 and below. No public exploit code or active exploitation confirmed at time of analysis; risk is bounded by the requirement for pre-existing high-privilege local access.
Physical-access authentication bypass in Dell Client Platform BIOS (CWE-305) affects a sweeping range of Dell consumer, gaming, and enterprise platforms - including Inspiron, Alienware, Latitude, OptiPlex, and Precision lines. An unauthenticated attacker with physical access and the ability to meet high-complexity attack conditions can bypass the primary BIOS authentication mechanism, resulting in information disclosure and, per the CVSS integrity metric (I:H), potential high-integrity impact. Notably, the declared impact in the description is limited to 'Information Disclosure' while the supplied CVSS vector assigns I:H, a discrepancy that warrants clarification from Dell's advisory DSA-2026-195. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local attacker to authenticate using those credentials and access sensitive information. Reported by Dell under DSA-2026-247, the flaw is classified under CWE-1392 (Use of Default Credentials) and carries a CVSS 3.1 base score of 6.0, reflecting local-only attack surface constrained by the requirement for high privilege. No public exploit code or CISA KEV listing has been identified at time of analysis.
Host Header Injection in Dell PowerFlex Rack RCM 3.7 enables unauthenticated remote attackers to trigger open redirects by supplying a forged HTTP Host header, potentially redirecting victim users to attacker-controlled sites for phishing or credential harvesting. The CVSS 4.3 Medium score reflects the requirement for user interaction (UI:R) and limited confidentiality impact, with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and the vulnerability has no CISA KEV listing.
SQL injection in Dell PowerFlex Manager exposes database contents to low-privileged adjacent-network attackers via insufficiently sanitized SQL command input. The vulnerability requires both network adjacency and existing low-level credentials, limiting its reach considerably from an opportunistic threat standpoint. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis; the CVSS score of 3.5 (Low) reflects the constrained attack surface.
Dell PowerFlex Manager's improper access control (CWE-284) permits a remote, low-privileged attacker to cause a denial of service condition against the management platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable with minimal complexity once credentials are obtained, and is limited in scope to availability degradation (A:L). No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager 4.6.0.1 exposes network-accessible infrastructure management communications to potential interception and modification. Remote unauthenticated attackers who achieve the requisite network positioning - consistent with the CVSS AC:H rating - could exploit weak or deprecated cryptographic primitives to partially disclose sensitive management data (C:L) or tamper with communications in transit (I:L). Dell has published advisory DSA-2026-066 under the multi-CVE release DSA-2026-066; no public exploit code and no active exploitation (CISA KEV absent) have been identified at time of analysis.
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
update_disk_psu_baseline.sh requires password in plain text. Rated high severity (CVSS 7.4).
api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions. Rated high severity (CVSS 7.0). This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. Rated medium severity (CVSS 6.7).
Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. Rated medium severity (CVSS 6.7).
Weak password encoding in Dell Client Platform BIOS (CWE-261) exposes BIOS credentials to recovery by a physically present unauthenticated attacker, enabling privilege escalation through unauthorized BIOS access. Affected hardware spans ruggedized Latitude field devices, Precision workstation towers and racks, and Edge/Embedded Gateway platforms - product categories frequently deployed in physically accessible or unattended environments. No public exploit code exists and no active exploitation has been identified at time of analysis, but the combination of credential recoverability and high-confidentiality/high-integrity CVSS impact makes patching a priority for organizations managing assets in low-physical-security locations.
Arbitrary file write in Dell/Alienware Purchased Apps versions prior to 1.1.32.0 is achievable by a low-privileged local attacker through a link-following (CWE-59) flaw, enabling overwrite of files at elevated privilege levels and resulting in high integrity and availability impact. The CVSS vector (AV:L/AC:H/PR:L) confirms local access with high attack complexity is required, suggesting exploitation likely involves a race condition or carefully staged symlink placement. No active exploitation is confirmed (not in CISA KEV), and a vendor-released patch is available at version 1.1.32.0.
Arbitrary file write in Dell Inventory Collector Client versions prior to 13.8.0 allows a low-privileged local attacker to overwrite files outside the intended write path by exploiting improper symbolic or hard link resolution. The vulnerability (CWE-1386) arises when the client resolves a link to an unintended target before performing a file access operation, enabling an attacker to redirect writes to attacker-controlled locations. No public exploit has been identified at time of analysis and CISA KEV confirmation is absent, but the high integrity and availability impact (CVSS I:H/A:H) means successful exploitation could corrupt system files or cause denial of service.
Link-following (symlink attack) in Dell iDRAC Tools versions prior to 11.4.1.0 allows a low-privileged local attacker to redirect file operations to unintended targets, resulting in unauthorized modification of files (high integrity impact) and potential availability disruption. Exploitation requires both low-level local access and user interaction, placing this in a constrained attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and no EPSS score was supplied in source data.
Denial of service in Dell BSAFE SSL-J allows unauthenticated remote attackers to exhaust resources on systems using the cryptographic library, rendering affected services unavailable. The flaw stems from CWE-770 (allocation of resources without limits or throttling) and carries a CVSS 7.5 score reflecting network-reachable, no-privilege exploitation with high availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated attacker to bypass access controls, exposing sensitive information with high confidentiality and integrity impact. The flaw, rooted in CWE-284 (Improper Access Control), enables circumvention of authentication or authorization mechanisms at the device level without requiring prior credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit has been identified; Dell has released a patched build addressing this issue.
Improper authorization in Dell Unisphere for PowerMax (the VMAX management application running inside the vApp/Virtual Appliance) lets remote, unauthenticated attackers bypass access controls and perform actions or modify data they should not be permitted to reach. The CVSS 3.1 vector (C:N/I:H/A:N) scopes the impact to integrity - unauthorized state or data changes - rather than data disclosure or denial of service. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Broken access control in the Identity and Access Management (IAM) module of Dell ECS (Elastic Cloud Storage) 3.5 and 3.6 lets a remote, unauthenticated attacker read data they should not be able to reach. The flaw exposes confidential object/storage data without granting write or availability impact, and it is fixed in maintenance releases 3.5.1.7 and 3.6.2.4. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-privileged local users, resulting in unauthorized disclosure of confidential data with high confidentiality impact per CVSS. Affected deployments span both the Appliance and Rack form factors of the platform. No public exploit code has been identified at time of analysis and CISA KEV does not list this vulnerability, though the CWE-922 root cause and the 'Authentication Bypass' tag suggest the exposed data may include credentials or tokens that could enable downstream privilege escalation or lateral movement.
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager's SSH component (versions ≤4.6.2) allows a locally authenticated low-privileged attacker to bypass SSH protection mechanisms, affecting both Appliance and Rack form factors. The CVSS vector (AV:L/AC:H/PR:L) reflects significant exploitation barriers: physical or logical local access is required, attack complexity is high, and impact is limited to partial confidentiality and integrity loss with no availability impact. Dell has published dual advisories (DSA-2025-434 for Appliance, DSA-2025-435 for Rack); no public exploit or CISA KEV listing exists at time of analysis.
Open redirect in Dell PowerFlex Manager versions 4.6.2 and prior lets an unauthenticated remote attacker craft a link that, once clicked by a targeted user, silently forwards them from the trusted PowerFlex Manager domain to an attacker-controlled URL. Because the redirect abuses the credibility of the management interface, it is primarily a phishing and credential-harvesting enabler rather than a direct server compromise. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Improper certificate validation in Dell PowerFlex Manager version 4.6.2 and earlier allows an unauthenticated attacker on an adjacent network to intercept and tamper with protected communications. The flaw (CWE-295) means the product fails to adequately verify peer certificates during TLS/SSL exchanges, enabling a man-in-the-middle position to read or modify in-transit management data. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentials, keys, or configuration secrets to any attacker with local OS-level access to the appliance - no PowerFlex Manager authentication required. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs only local system access, not application credentials, to retrieve the improperly protected data. No public exploit identified at time of analysis and no CISA KEV listing; however, the 'Authentication Bypass' tag in the intelligence data suggests the exposed sensitive material may itself enable downstream privilege escalation or authentication bypass against PowerFlex or its managed infrastructure.
Elevation of privilege in Dell PowerFlex Manager (versions <=4.6.2, including the Appliance and Rack variants) allows a local, low-privileged user to gain higher privileges through an Incorrect Privilege Assignment (CWE-266) flaw. An attacker who already has a foothold on the management host can abuse mis-scoped privileges to achieve full confidentiality, integrity, and availability impact on the system. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Information exposure in Dell PowerFlex Manager (Appliance, Rack, and standalone) versions <=4.6.2 allows unauthenticated remote attackers to read directory listings served by the management interface, exposing file and path names that can reveal sensitive configuration and system details. The flaw is remotely reachable without credentials or user interaction (CVSS 7.5), but there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02%. CISA's SSVC framework rates exploitation as 'none' and technical impact as 'partial,' indicating a genuine but non-critical disclosure issue rather than a code-execution threat.
Information disclosure in Dell PowerFlex Manager (Appliance, Rack, and core Manager) versions 4.6.2 and earlier allows unauthenticated remote attackers to enumerate server contents through exposed directory listings. The flaw carries a CVSS 7.5 (high) rating driven entirely by confidentiality impact and requires no privileges or user interaction, though no public exploit identified at time of analysis and the issue is not on CISA KEV.
Command injection in Dell SmartFabric Storage Software versions prior to 1.4.5 enables a high-privileged local attacker to gain unauthorized read and write access to the underlying filesystem. Exploitation requires local system presence and high-level privileges, with the CVSS vector (AV:L/AC:H/PR:H) indicating a constrained threat surface despite the high confidentiality, integrity, and availability impact scores. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Symbolic link exploitation in Portrait Dell Color Management (before 3.7.0) on Windows allows a local low-privileged user to escalate privileges to Administrator by redirecting an elevated installer file write to an arbitrary system path. During installation, the software writes CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ with Administrator-level privileges while failing to validate symlinks or reparse points at the destination - an attacker who pre-stages a malicious junction or symlink at that path gains arbitrary file creation or overwrite capability under the elevated context. No public exploit code has been identified at time of analysis; SSVC signals confirm no known active exploitation.