CVE-2026-35065: Dell PowerFlex Manager Missing Authentication Vulnerability

Technical summary

CVE-2026-35065 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Dell PowerFlex Manager prior to version 5.1.0.1. An attacker with adjacent network access can bypass authentication controls to access sensitive functionality, potentially achieving code execution and information disclosure without any user interaction. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of adjacent network accessibility, lack of authentication requirements, and high impact across confidentiality, integrity, and availability.

Business impact

Exploitation of this vulnerability could allow attackers to gain unauthorized control over PowerFlex Manager infrastructure, potentially impacting storage management, operational continuity, and data security. Organizations running affected versions risk unauthorized data access, malicious modifications to storage configurations, service outages, and lateral movement into critical storage systems. The attack surface is limited to adjacent network segments, but this still poses significant risk for organizations with hybrid or cloud-connected infrastructure.

Affected systems

Dell PowerFlex Manager versions prior to 5.1.0.1 are affected. Organizations should identify all PowerFlex Manager deployments in their environment and verify the installed version against the vulnerable range. Check vendor advisories for the complete list of affected versions and any additional product combinations that may be impacted.

Exploitability

The vulnerability is readily exploitable due to the absence of authentication requirements and the low attack complexity (AC:L). An attacker requires only adjacent network access and no user interaction to trigger exploitation. This lowers the barrier to entry for potential attackers and increases the likelihood of opportunistic attacks within accessible network segments. However, the requirement for adjacent network access (rather than network-wide access) provides some containment if internal network segmentation is properly configured.

Remediation

Update Dell PowerFlex Manager to version 5.1.0.1 or later. This patch addresses the missing authentication control for the vulnerable functionality. Prior to patching, restrict network access to PowerFlex Manager to authorized administrative networks and consider implementing network segmentation to limit exposure to adjacent network attackers.

Patch guidance

Vendors must verify against Dell's official security advisories for the definitive patch version and deployment steps. Typically, updates should be applied during scheduled maintenance windows to avoid operational disruption. Test patches in non-production environments first to ensure compatibility with your storage infrastructure and existing configurations.

Detection guidance

Monitor for unauthenticated access attempts to PowerFlex Manager administrative interfaces and APIs. Look for suspicious traffic from adjacent network segments attempting to interact with critical functions without valid authentication tokens or sessions. Check system logs for unexpected code execution, configuration changes, or service disruptions coinciding with network anomalies. Network-based detection could flag unusual connections to PowerFlex Manager ports from hosts outside trusted administrative networks.

Why prioritize this

This vulnerability warrants immediate prioritization due to its HIGH CVSS score (8.8), the critical nature of affected functionality, and the complete absence of authentication barriers. PowerFlex Manager is core storage infrastructure; compromise directly threatens data confidentiality, integrity, and availability. The low attack complexity and lack of exploitation barriers increase the practical threat level. While adjacent network access is required, many organizations have permissive internal network designs.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Attack Vector Adjacent (AV:A) limiting exposure but increasing impact for vulnerable segments; Attack Complexity Low (AC:L) enabling straightforward exploitation; Privileges Required None (PR:N) and User Interaction None (UI:N) demonstrating the complete authentication bypass; and high impact on Confidentiality, Integrity, and Availability (C:H/I:H/A:H) indicating broad system compromise potential. The score appropriately captures the critical risk posed by unauthenticated access to storage management functions.

Frequently asked questions