Dell fixes 44 PowerStore vulnerabilities, including seven CVSS 9.8 SDNAS flaws such as CVE-2026-116443. Upgrade to PowerStoreT OS 5.1.0.0-2798105.
Related Posts:
Critical MediaTek Vulnerabilities Patched in Chipsets
Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
Critical FreePBX Vulnerabilities Patched in User Manager
The post Dell Patches 44 PowerStore Vulnerabilities, Seven Rated CVSS 9.8 appeared first on Daily CyberSecurity.
Dell fixes PowerProtect Data Domain vulnerabilities in DD OS, including four CVSS 9.8 flaws like CVE-2026-86400 allowing root command execution.
Related Posts:
Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes
Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access
FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands
The post Dell Fixes Critical PowerProtect Data Domain Vulnerabilities, Four Rat
Apply the DSA-2026-405 security update for Dell Wyse Management Suite to fix four XSS flaws, including critical bug CVE-2026-82158 (CVSS 9.0).
Related Posts:
Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws
SiteGuard Server Edition Flaw CVE-2026-106931 Exploited in the Wild for Root Access
The post Dell Patches Four Critical Wyse Management Suite XSS Vulnerabilities appeared first on D
Dell warns that a critical DSU flaw lets attackers run code as root. Customers should patch affected PowerEdge systems as soon as possible.
Dell urged customers to patch a critical flaw, tracked as CVE-2026-86360 (CVSS score of 9.6), in its System Update (DSU) tool. The vulnerability is a path traversal issue that can let attackers execute code with root privileges on unpatched PowerEdge servers. This flaw could give attackers full control of vulnerable servers. DSU is used by enterprise IT
Dell warns that a critical DSU flaw lets attackers run code as root. Customers should patch affected PowerEdge systems as soon as possible.
Dell urged customers to patch a critical flaw, tracked as CVE-2026-86360 (CVSS score of 9.6), in its System Update (DSU) tool. The vulnerability is a path traversal issue that can let attackers execute code with root privileges on unpatched PowerEdge servers. This flaw could give attackers full control of vulnerable servers. DSU is used by enterprise IT teams to deploy BIOS, firmware and software updates on Linux and Windows systems. The vendor recommends applying the available security updates as soon as possible to prevent exploitation.
“Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.” reads the advisory. “This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.”
Beyond the critical CVE-2026-86360 flaw, Dell addressed four other vulnerabilities in System Update versions before 2.3.0.0. CVE-2026-86361 and CVE-2026-86362, both rated 8.2, could allow a low-privileged local attacker to gain higher privileges by exploiting incorrect permissions or access controls. CVE-2026-63697 (CVSS score of 7.6) is an improper certificate validation flaw that could allow a highly privileged remote attacker to execute code. CVE-2026-71168 (CVSS score of 7.3) is a path traversal vulnerability that could enable a low-privileged local attacker to achieve remote code execution. Together, the issues show that the affected tool can expose multiple paths to privilege escalation or code execution.
The company recommends updating System Update to version 2.3.0.0 or later.
Dell has not reported any active attacks exploiting these vulnerabilities so far.
Dell has released security update DSA-2026-448 to address multiple critical vulnerabilities in its Container Storage Modules, including flaws that could allow unauthenticated remote attackers to take full administrative control of affected storage environments.
Organizations using vulnerable Dell CSM deployments should upgrade immediately, as Dell stated that no workarounds or mitigations are available.
The advisory affects Dell Container Storage Modules versions before 1.17.0, with fixes
Dell has released security update DSA-2026-448 to address multiple critical vulnerabilities in its Container Storage Modules, including flaws that could allow unauthenticated remote attackers to take full administrative control of affected storage environments.
Organizations using vulnerable Dell CSM deployments should upgrade immediately, as Dell stated that no workarounds or mitigations are available.
The advisory affects Dell Container Storage Modules versions before 1.17.0, with fixes available in 1.18.0 and later, covering CSM Authorization, CSM Operator, CSI components, and third-party Go libraries.
The most severe vulnerabilities are CVE-2026-63688 and CVE-2026-63692, both assigned a CVSS score of 10.0. CVE-2026-63688 is a missing authentication flaw in the csm-authorization-storage gRPC server in CSM Authorization version 2.4.0.
An unauthenticated attacker could exploit the flaw to access administrator credentials for all registered storage arrays, potentially gaining control across Dell’s five supported storage product families.
Access to backend administrator credentials could enable an attacker to change storage configurations, access sensitive data, disrupt workloads, or create persistent access paths within the environment.
Critical Dell Container Storage Flaws
CVE-2026-63692 also affects CSM Authorization version 2.4.0. The vulnerability exists in the authorization proxy and tenant service, where critical functions can be reached without proper authentication.
Successful exploitation could allow a network-based attacker to bypass authentication controls and elevate privileges to the administrative level. This could expose and enable manipulation of storage resources across all tenants.
Another critical issue, CVE-2026-54472, is a hard-coded credentials vulnerability in CSM Authorization. The flaw could allow an unauthenticated remote attacker to forge cryptographically valid administrative JSON Web Tokens and gain administrator access to the CSM Authorization proxy.
Dell rated the flaw CVSS 9.8 and advised rotating JWT signing secrets after updating, the advisory also addresses CVE-2026-61421 in the archived karavi-authorization component.
Dell said older documentation used the JWT signing secret “supersecret” alongside a real token example. Organizations that deployed karavi-authorization using this documented value and never changed the signing secret may remain exposed to forged-token attacks and administrative takeover.
CVE-2026-67269 in Dell CSM Operator 1.12.0 could let low-privileged remote users gain root access to Kubernetes nodes via a malicious ContainerStorageModule resource, Dell rated it 9.9 due to potential cluster-wide compromise.
CVE-2026-67273, rated 9.6, could permit a low-privileged attacker to access Kubernetes Secrets and create cluster-scoped RBAC resources through template-engine injection. Such access could effectively bypass intended Kubernetes permissions and allow broad control of cluster resources.
Other flaws include improper certificate validation, missing authorization in the Dell CSI Driver for PowerMax, sensitive-information disclosure through logs, and flaws affecting CSI drivers for PowerFlex, PowerMax, and PowerStore.
The update also addresses vulnerabilities in third-party Go components, including golang.org/x/crypto, golang.org/x/net, golang-jwt/jwt, and protobuf.
Dell recommends upgrading all affected Container Storage Modules deployments to version 1.18.0 or later at the earliest opportunity. Security teams should also rotate JWT secrets, review CSM Authorization access logs, audit administrative token usage, and check Kubernetes RBAC policies and custom resources for unauthorized changes.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response:Integrate TI Lookup in your SOC
Dell System Update flaw CVE-2026-86360 (CVSS 9.6) could let attackers run code as root. Dell fixes five bugs in DSU 2.3.0.0. Patch now.
Related Posts:
Citrix NetScaler CVE-2026-88779 Exploited in the Wild to Knock SAML Gateways Offline
Unpatched Apache OpenOffice Vulnerability Leads New Apache Advisories for LDAP API and Traffic Server
Microsoft Reissues September 2026 Exchange Server Security Updates to Add CVE-2026-96940
The post Dell System Update Flaw CVE-2026-86360 Could Allow Root Code
Dell Container Storage Modules vulnerabilities CVE-2026-63688 and CVE-2026-63692 (CVSS 10) allow admin takeover. Upgrade to 1.18.0.
Related Posts:
Stirling PDF RCE CVE-2026-85714: Details and PoC Publicly Disclosed
Dell System Update Flaw CVE-2026-86360 Could Allow Root Code Execution
Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach
The post Dell Patches Two CVSS 10 Flaws in Container Storage Modules appeared first on Daily CyberSecurity.
Dell patched critical Dell Terraform Provider vulnerabilities. CVE-2026-91881 exposes BMC traffic to attackers. Upgrade your providers to stay safe.
Related Posts:
PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545
ASUS Security Vulnerabilities Expose Routers and Motherboards
MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public
The post 9.0 CVSS Dell Terraform Provider Vulnerabilities Exposed appeared first on Daily CyberSecurity.
Entrar
