Story · 4 sources · 5 articlesfirst Oct 3, 03:52 UTCupdated Oct 6, 12:57 UTC (2d ago)

Dell patches critical Container Storage and System Update flaws

highVulnerabilityimportance 76CVE-2026-63688 CVE-2026-63692 CVE-2026-67269 CVE-2026-54472 CVE-2026-6727 CVE-2026-86360 CVE-2026-61421 CVE-2026-67273

What's new: The newest Oct. 6 report names DSU advisory DSA-2026-324, published Oct. 1, 2026, and says CVE-2026-86360’s CVSS vector requires user interaction. It also maps the other four fixes: CVE-2026-86361 and CVE-2026-86362 as CVSS 8.2 local privilege bugs, CVE-2026-63697 as CVSS 7.6 improper certificate validation, and CVE-2026-71168 as a CVSS 7.3 path traversal.

Merged summary · grok-4.7 · rewritten as coverage arrives

Dell patched critical Container Storage Module and System Update flaws, including two CVSS 10.0 bypasses and a CVSS 9.6 path traversal, with no known exploitation.

Dell published DSA-2026-448 for critical Container Storage Module flaws before 1.17.0, fixed in 1.18.0 or later. CVE-2026-63688 and CVE-2026-63692, both CVSS 10.0, let unauthenticated attackers reach CSM Authorization 2.4.0 administrative functions and storage-array credentials; CVE-2026-54472 (CVSS 9.8) uses hard-coded credentials to forge administrative JWTs, and CVE-2026-67269 (CVSS 9.9) can give low-privileged users root on Kubernetes nodes. CSO Online expands the story to 18 critical flaws in CSM and Dell System Update, with CSM before 1.17.0 and DSU before 2.3.0.0 affected and fixes in CSM 1.18.0+ and DSU 2.3.0.0+, and says Dell has no evidence of exploitation. Separately, DSA-2026-324, published Oct. 1, 2026, covers five DSU flaws, led by path-traversal CVE-2026-86360 (CVSS 9.6), which reports say can let a remote unauthenticated attacker access the filesystem and run code as root on PowerEdge servers; the newest account adds that the CVSS vector requires user interaction. Sources disagree on one CVSS 9.6 CSM identifier, listing CVE-2026-67273 or CVE-2026-6727, and differ on CVE-2026-63697 (7.6) and CVE-2026-71168 (7.3), described either as remote execution or as improper certificate validation and another path traversal, while CVE-2026-86361 and CVE-2026-86362 are both CVSS 8.2 local privilege issues. No source reports workarounds or known exploitation; the earliest also advises rotating JWT secrets and reviewing authorization logs and RBAC.

DSA-2026-448 covers Dell Container Storage Modules before 1.17.0, fixed in 1.18.0 or later; Dell says no workarounds exist.
CVE-2026-63688 and CVE-2026-63692, both CVSS 10.0, let unauthenticated attackers reach CSM Authorization 2.4.0 admin functions and storage-array credentials.
CVE-2026-54472 (CVSS 9.8) uses hard-coded credentials to forge administrative JWTs; CVE-2026-67269 (CVSS 9.9) can give low-privileged users root on Kubernetes nodes.
CSO Online says 18 critical CSM and Dell System Update flaws were disclosed and that Dell has no evidence of exploitation; sources disagree on a CVSS 9.6 CSM id, citing CVE-2026-67273 or CVE-2026-6727.
DSA-2026-324, published Oct. 1, 2026, covers five Dell System Update flaws before 2.3.0.0 on PowerEdge update workflows, fixed in 2.3.0.0 or later.
CVE-2026-86360 (CVSS 9.6) is a path traversal that can give a remote unauthenticated attacker filesystem access and root code execution; one report says its CVSS vector requires user interaction.

VendorsDell

ProductsDell Container Storage Modules Dell System Update PowerEdge Container Storage Modules CSM Authorization CSM Operator karavi-authorization PowerMax PowerFlex PowerStore Dell PowerEdge

OrganizationsBeauceron Security Info-Tech Research Group Dell

Coverage timelineoldest first · each row is one article

Oct 3, 03:52 UTC · 5d ago
Cyber Security News· 76
Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control
Dell patched multiple critical Container Storage Module flaws, including two CVSS 10.0 bugs that let unauthenticated attackers seize administrative control.
Oct 6, 01:25 UTC · 2d ago
CSO Online· 76
Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes
Dell patched 18 critical CSM and DSU flaws, including two CVSS 10 authentication bypasses, with no known exploitation.
Oct 6, 07:01 UTC · 2d ago
Security Affairs· 68
Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access

Vulnerabilities in this storyAll →

CVE-2026-6368810.0—
Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server
published 2d ago· Dell Container Storage Modules (CSM) - csm-authorization-storage gRPC server (CSM Authorization module)+4 related
CVE-2026-863609.6—
Unauthenticated Path Traversal to Root Code Execution in Dell System Update
published 2d ago· Dell System Update (DSU)+4 related

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-63688 +4 related CVEs CVE-2026-63692 CVE-2026-67269 CVE-2026-61421 CVE-2026-54472	Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server Dell Container Storage Modules (CSM) before v1.18.0 ships a csm-authorization-storage gRPC server that fails to authenticate callers on a critical function (CWE-306). An unauthenticated remote attacker who can reach the gRPC endpoint can invoke that function and retrieve the storage backend administrator credentials for every storage array registered with the CSM Authorization module. Because those credentials typically grant full administrative control of the underlying storage systems, the flaw can cascade into complete compromise of storage and, by extension, the Kubernetes workloads depending on it. The bug scores a perfect CVSS 3.1 of 10.0 (network, low complexity, no privileges or user interaction, scope change, high impact to confidentiality, integrity, and availability). Dell has patched the issue and is urging admins to apply updates promptly, but there is no known public PoC and no confirmed in-the-wild exploitation, and it is not yet on the CISA KEV list. Do: Upgrade Dell CSM to v1.18.0 or later immediately, prioritizing any cluster running the CSM Authorization module. Until patched, restrict network access to the csm-authorization-storage gRPC server (e.g., Kubernetes NetworkPolicies and firewall rules limiting reachability to trusted pods/segments only) and verify it is not exposed outside the cluster. After patching, rotate the administrator credentials for all registered storage arrays and audit logs for unexplained gRPC calls or suspicious storage-array logins, since the credentials could have been silently harvested before the fix.	10.0 group max	—	Dell Container Storage Modules (CSM) - csm-authorization-storage gRPC server (CSM Authorization module) prior to v1.18.0 (< 1.18.0)	moderatelikely low thousands of installations (thousands of Kubernetes clusters running CSM Authorization against Dell storage arrays)	2d ago
CVE-2026-86360 +4 related CVEs CVE-2026-86361 CVE-2026-86362 CVE-2026-63697 CVE-2026-71168	Unauthenticated Path Traversal to Root Code Execution in Dell System Update Dell System Update (DSU) versions prior to 2.3.0.0 contain a path traversal flaw (CWE-22) that lets an unauthenticated remote attacker break out of a restricted directory and gain filesystem access on the host. The CVSS 3.1 vector (AV:N/PR:N/UI:R) indicates exploitation is network-reachable and needs no credentials, but does require some user interaction, suggesting a crafted request or link that tricks an administrator session into triggering the malicious path. Successful exploitation allows the attacker to write or access files outside the intended directory, ultimately enabling arbitrary code execution with root privileges and full compromise of the application and underlying operating system. The flaw affects Dell servers (typically PowerEdge running Linux) where DSU is installed and its interface is reachable by the attacker. No public proof-of-concept exists, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported; Dell has issued a fix and urges immediate upgrade. Do: Upgrade Dell System Update to version 2.3.0.0 or later on every server where it is installed. Restrict DSU's network interface to trusted management networks and VPNs so unauthenticated remote requests cannot reach it, and train admins not to browse untrusted sites while a DSU session is active given the user-interaction requirement in the CVSS vector. On patched-but-previously-exposed hosts, review for signs of prior abuse such as unexpected files written via traversal paths, unfamiliar root-owned binaries, cron jobs, or new SUID files.	9.6 group max	—
CVE-2026-6727	Timing Side-Channel in TCG TPM 2.0 Reference Code RSA-OAEP Decryption CVE-2026-6727 is a timing side-channel vulnerability (CWE-208, tracked as TCGVRT0011) in the RSA OAEP decryption implementation of TPM 2.0 code derived from the Trusted Computing Group reference implementation. A privileged local attacker with access to the TPM command interface can measure timing differences across decryption operations to recover information sufficient to decrypt ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, the leaked information may also enable forgery of TPM 2.0 attestations, undermining trust in remote-attestation results. Any platform whose TPM 2.0 firmware is built from the affected TCG reference code is potentially affected, which spans TPM silicon from multiple vendors shipped across modern PCs, laptops, and servers; per-vendor exposure depends on whether the vulnerable code path was adopted. No public proof-of-concept or known exploitation exists (EPSS 0.2% over 30 days, not in CISA KEV). Do: Inventory devices by TPM vendor/model and monitor for TPM firmware or driver fixes tied to TCGVRT0011 and VU#431093; apply updates from the device or silicon vendor as they are released, potentially surfacing through OS patch channels such as Microsoft's August 2026 Patch Tuesday. Until patched, restrict local privileged access to the TPM command interface to trusted code and weigh the risk of relying on TPM attestation for high-assurance operations. With no known exploitation and a high-complexity, local attack requirement, treat this as standard patch-cycle priority rather than an emergency.	5.9	<1%	Trusted Computing Group TPM 2.0 reference code (TCGVRT0011 / VU#431093) TPM 2.0 implementations built from the TCG reference code
CVE-2026-67273	Template Injection Privilege Escalation in Dell CSM Dell Container Storage Modules before 1.18.0 fail to neutralize special elements in a template engine (CWE-1336), a template-injection flaw. A remote attacker who already has low privileges can trigger it over the network with low complexity and no user interaction. Because the scope changes, the impact extends beyond the vulnerable component, with high confidentiality and integrity impact and no availability impact stated in the CVSS vector (9.6 critical), resulting in privilege escalation. Sites running Dell CSM for container storage on Kubernetes are affected if they have not moved to 1.18.0. No public proof of concept is known and the issue is not in CISA KEV, so exploitation in the wild is not known; related reporting urges prompt patching of critical CSM flaws. Do: Upgrade Dell Container Storage Modules to version 1.18.0 or later. Until that is done, limit network access to CSM interfaces to trusted administrators and review low-privilege accounts that can reach the template features.	9.6	—	Dell Container Storage Modules prior to 1.18.0	nicheunknown (likely thousands of enterprise Kubernetes clusters, not a mass consumer footprint)	2d ago