PowerFlex (Product): news timeline & CVEs

Related CVEsby mentions

CVE-2026-6369210.0—

Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)

published 2d ago· Dell (Dell EMC) Container Storage Modules (CSM)

CVE-2026-6368810.0—

Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server

published 2d ago· Dell Container Storage Modules (CSM) - csm-authorization-storage gRPC server (CSM Authorization module)

CVE-2026-672699.9—

Privilege Escalation to Root on Kubernetes Nodes in Dell CSM Operator

published 2d ago· Dell Container Storage Modules (CSM) Operator

CVE-2026-614219.8—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) Authorization, pre-1.18.0

published 2d ago· Dell Container Storage Modules (CSM) — CSM Authorization component

CVE-2026-672739.6—

Template Injection Privilege Escalation in Dell CSM

published 2d ago· Dell Container Storage Modules

CVE-2026-544727.5—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) csm-docs

published 2d ago· Dell Container Storage Modules (CSM)

CVE-2026-2276910.013%

Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access

published Feb 17, 2026· Dell RecoverPoint for Virtual Machines (RP4VMs) KEV

CVE-2021-215517.879%

Local Privilege Escalation in Dell dbutil_2_3.sys Driver

published May 4, 2021· Dell dbutil driver (dbutil_2_3.sys) KEV PoC ×2

Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control

Dell patched multiple critical Container Storage Module flaws, including two CVSS 10.0 bugs that let unauthenticated attackers seize administrative control.

Dell published DSA-2026-448 for critical flaws in Container Storage Modules before 1.17.0, fixed in 1.18.0 and later. CVE-2026-63688 and CVE-2026-63692, both CVSS 10.0, let unauthenticated attackers reach CSM Authorization 2.4.0 admin functions and storage-array credentials across Dell's supported families. CVE-2026-54472 (CVSS 9.8) uses hard-coded credentials to forge administrative JWTs, while CVE-2026-67269 (CVSS 9.9) and CVE-2026-67273 (CVSS 9.6) can yield Kubernetes node root or cluster RBAC abuse. Dell said no workarounds exist and advised upgrading, rotating JWT secrets, and reviewing authorization logs and RBAC.

Cyber Security Newsupdated Oct 6, 12:57 UTC · 2d agofirst Oct 3, 03:52 UTC · 5d agoVulnerability 5 sources CVE-2026-63688 CVE-2026-63692 CVE-2026-54472+3 CVEs5· 1 read

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.

Dell patched six critical flaws in Container Storage Modules, which link PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays to Kubernetes. CVE-2026-63688 and CVE-2026-63692, both missing-authentication bugs in CSM Authorization, let unauthenticated remote attackers steal storage admin credentials or bypass auth and take full administrative control, including across tenants. Four further flaws allow root on cluster nodes (CVE-2026-67269), admin access to the authorization proxy (CVE-2026-54472), forged admin tokens (CVE-2026-61421), and cluster-wide reads of Kubernetes Secrets (CVE-2026-67273). Dell urges an upgrade to version 1.18.0 or later and has not reported active exploitation of these bugs.

BleepingComputerOct 2, 12:37 UTC · 6d agoVulnerability CVE-2026-63688 CVE-2026-63692 CVE-2026-67269+5 CVEs1

PowerFlex

Timeline2 articles

Related CVEsby mentions

Appears with

Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control

Dell asks admins to patch max severity CSM flaws as soon as possible