CVE-2026-35065

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:powerflex_manager::::::::
	cpe:2.3:a:dell:powerflex_manager::::::::

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Dell PowerFlex Manager, versión(es) anterior(es) a la 5.1.0.1, contiene una vulnerabilidad de autenticación faltante para función crítica. Un atacante no autenticado con acceso a la red adyacente podría potencialmente explotar esta vulnerabilidad, lo que podría llevar a la ejecución de código, denegación de servicio, revelación de información, manipulación de información, ejecución remota, inyección de scripts y acceso no autorizado.

Information

Published : 2026-06-17 15:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-35065

Mitre link : CVE-2026-35065

CVE.ORG link : CVE-2026-35065

JSON object : View

Products Affected

dell

powerflex_manager

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-35065", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35065", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T16:09:44.226124Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "PowerFlex", "versions": [{"status": "affected", "version": "0", "lessThan": "5.1.0.1 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.5.5.2 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-17T15:16:45.807", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access."}, {"lang": "es", "value": "Dell PowerFlex Manager, versi\u00f3n(es) anterior(es) a la 5.1.0.1, contiene una vulnerabilidad de autenticaci\u00f3n faltante para funci\u00f3n cr\u00edtica. Un atacante no autenticado con acceso a la red adyacente podr\u00eda potencialmente explotar esta vulnerabilidad, lo que podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo, denegaci\u00f3n de servicio, revelaci\u00f3n de informaci\u00f3n, manipulaci\u00f3n de informaci\u00f3n, ejecuci\u00f3n remota, inyecci\u00f3n de scripts y acceso no autorizado."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F1EE8D3-8814-4DFD-9F39-73B2E1CFED52", "versionEndExcluding": "4.5.5.2"}, {"criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56FAF94E-4638-489B-9580-7BDBE8A0767A", "versionEndExcluding": "5.1.0.1", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}