CVE-2026-76111

Dell PowerStore contains an incorrect authorization flaw (CWE-863) in which certain administrator-only operations are not properly access-controlled. A network-based attacker who already holds a low-privileged, authenticated account on the appliance can invoke these restricted operations directly, with no user interaction required. Successful exploitation grants the attacker elevated (administrator-level) access to the affected system, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All Dell PowerStore deployments are potentially affected, particularly environments where untrusted or minimally privileged users are granted access to the system over the network. As of this writing there is no known public proof-of-concept, no entry in the CISA Known Exploited Vulnerabilities catalog, and a low predicted exploitation probability (EPSS ~0.3% over 30 days).

What to do: Upgrade PowerStore OS to the fixed release identified in Dell's security advisory (version ranges were not included in the source data). Until patched, restrict low-privileged accounts and network access to PowerStore management interfaces to trusted users only, and audit recent administrative operations for signs of unauthorized actions. Check the Dell advisory for the definitive list of affected model/version combinations before planning the upgrade.