Container Storage Modules (Product): news timeline & CVEs

Related CVEsby mentions

CVE-2026-6368810.0—

Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server

published 2d ago· Dell Container Storage Modules (CSM) - csm-authorization-storage gRPC server (CSM Authorization module)

CVE-2026-6369210.0—

Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)

published 2d ago· Dell (Dell EMC) Container Storage Modules (CSM)

CVE-2026-2276910.013%

Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access

published Feb 17, 2026· Dell RecoverPoint for Virtual Machines (RP4VMs) KEV

CVE-2021-215517.879%

Local Privilege Escalation in Dell dbutil_2_3.sys Driver

published May 4, 2021· Dell dbutil driver (dbutil_2_3.sys) KEV PoC ×2

CVE-2026-672699.9—

Privilege Escalation to Root on Kubernetes Nodes in Dell CSM Operator

published 2d ago· Dell Container Storage Modules (CSM) Operator

CVE-2026-614219.8—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) Authorization, pre-1.18.0

published 2d ago· Dell Container Storage Modules (CSM) — CSM Authorization component

CVE-2026-672739.6—

Template Injection Privilege Escalation in Dell CSM

published 2d ago· Dell Container Storage Modules

CVE-2026-544727.5—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) csm-docs

published 2d ago· Dell Container Storage Modules (CSM)

CVE-2026-863609.6—

Unauthenticated Path Traversal to Root Code Execution in Dell System Update

published 2d ago· Dell System Update (DSU)

CVE-2026-711687.3—

Path Traversal to Root Code Execution in Dell System Update before 2.3.0.0

published 2d ago· Dell System Update (DSU)

New Dell System Update flaw lets hackers gain root privileges

Dell warns a critical System Update path-traversal flaw, CVE-2026-86360, lets unauthenticated attackers run code as root.

Dell warned that CVE-2026-86360, a critical path-traversal flaw in the Dell System Update CLI, lets an unauthenticated remote attacker access the filesystem and execute arbitrary code as root on unpatched systems. The same update fixes high-severity DSU bugs CVE-2026-63697 and CVE-2026-71168 for remote code execution and CVE-2026-86361 and CVE-2026-86362 for privilege escalation; customers should move to DSU 2.3.0.0 or later. Dell also urged immediate patching of maximum-severity Container Storage Modules flaws CVE-2026-63688 and CVE-2026-63692. Dell has not flagged these new issues as actively exploited.

BleepingComputerOct 5, 14:53 UTC · 3d agoVulnerability CVE-2026-86360 CVE-2026-63697 CVE-2026-71168+6 CVEs2

Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control

Dell patched multiple critical Container Storage Module flaws, including two CVSS 10.0 bugs that let unauthenticated attackers seize administrative control.

Dell published DSA-2026-448 for critical flaws in Container Storage Modules before 1.17.0, fixed in 1.18.0 and later. CVE-2026-63688 and CVE-2026-63692, both CVSS 10.0, let unauthenticated attackers reach CSM Authorization 2.4.0 admin functions and storage-array credentials across Dell's supported families. CVE-2026-54472 (CVSS 9.8) uses hard-coded credentials to forge administrative JWTs, while CVE-2026-67269 (CVSS 9.9) and CVE-2026-67273 (CVSS 9.6) can yield Kubernetes node root or cluster RBAC abuse. Dell said no workarounds exist and advised upgrading, rotating JWT secrets, and reviewing authorization logs and RBAC.

Cyber Security Newsupdated Oct 6, 12:57 UTC · 2d agofirst Oct 3, 03:52 UTC · 5d agoVulnerability 5 sources CVE-2026-63688 CVE-2026-63692 CVE-2026-54472

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.

Dell patched six critical flaws in Container Storage Modules, which link PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays to Kubernetes. CVE-2026-63688 and CVE-2026-63692, both missing-authentication bugs in CSM Authorization, let unauthenticated remote attackers steal storage admin credentials or bypass auth and take full administrative control, including across tenants. Four further flaws allow root on cluster nodes (CVE-2026-67269), admin access to the authorization proxy (CVE-2026-54472), forged admin tokens (CVE-2026-61421), and cluster-wide reads of Kubernetes Secrets (CVE-2026-67273). Dell urges an upgrade to version 1.18.0 or later and has not reported active exploitation of these bugs.

BleepingComputerOct 2, 12:37 UTC · 6d agoVulnerability CVE-2026-63688 CVE-2026-63692 CVE-2026-67269+5 CVEs1

Container Storage Modules

Timeline3 articles

Related CVEsby mentions

Appears with

New Dell System Update flaw lets hackers gain root privileges

Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control

Dell asks admins to patch max severity CSM flaws as soon as possible