CVE-2026-79687

Dell PowerStore SDNAS, the NAS/file-services component of Dell PowerStore storage arrays, has a missing-authentication flaw (CWE-306): a critical function can be reached without any credentials. An unauthenticated attacker with remote network access to the SDNAS interface can trigger the flaw, though the CVSS score reflects high attack complexity, so some non-trivial conditions are involved. A successful attacker gains filesystem access, with high impact on confidentiality, integrity, and availability, and the changed scope in the CVSS vector indicates the impact extends beyond the SDNAS component itself to the broader system. Only organizations running Dell PowerStore arrays with the SDNAS (NAS file services) component enabled and network-reachable are affected. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation, with EPSS estimating only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade PowerStore systems to the fixed software release identified in Dell's security advisory, as the available data does not specify affected or fixed version ranges. Until patching is complete, restrict SDNAS/NAS interfaces to trusted network segments and verify whether SDNAS file services are enabled and reachable by unauthenticated users. Monitor the Dell advisory for updated affected-version and remediation details.