CVE-2026-35066: Dell PowerFlex Manager Improper Access Control – DoS Vulnerability

Technical summary

CVE-2026-35066 is an improper access control vulnerability (CWE-284) in Dell PowerFlex Manager affecting versions prior to 5.1.0.1. The flaw allows a low-privileged, remotely-authenticated user to trigger a denial-of-service condition. The CVSS 3.1 score of 7.1 (HIGH severity) reflects the network-accessible attack vector, low complexity, low privilege requirement, and high availability impact, though confidentiality and integrity are not directly affected. The vulnerability requires an existing user account but no special user interaction to exploit.

Business impact

Exploitation could cause temporary or extended unavailability of PowerFlex Manager, disrupting storage infrastructure administration, monitoring, and provisioning operations. Organizations dependent on PowerFlex for storage management may experience operational delays, potential SLA violations, and reduced visibility into their storage environment. The attack requires authentication but not admin privileges, widening the attack surface to any user account in the system.

Affected systems

Dell PowerFlex Manager versions prior to 5.1.0.1 are vulnerable. Organizations running affected versions should audit their current deployments and prioritize upgrades. The vulnerability affects the management interface itself, meaning any organization using PowerFlex Manager for infrastructure management may be impacted if running unpatched versions.

Exploitability

Exploitability is moderate to high in realistic environments. The attack requires network access and a valid user account with low privileges—credentials that may already be compromised, widely distributed, or belong to contractors and service accounts with limited intended access. No special tools or sophisticated techniques are needed; the low attack complexity suggests the vulnerability is straightforward to trigger once authentication is obtained. However, the current threat landscape assessment shows this vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later. Organizations should verify the exact current version in their environment, test the patch in a non-production setting, and plan a controlled rollout to minimize operational disruption. Dell's official advisory should be consulted for any version-specific migration guidance or prerequisites.

Patch guidance

1. Identify all systems running Dell PowerFlex Manager and determine their current versions. 2. Consult Dell's official security advisory and release notes for version 5.1.0.1 and later to confirm patch availability and any compatibility considerations. 3. Test the upgrade in a development or staging environment matching your production configuration. 4. Schedule the upgrade during a maintenance window; verify rollback procedures beforehand. 5. After patching, confirm successful deployment and re-enable any security monitoring or access controls that may have been temporarily disabled. 6. Document the patched version and patch date for compliance tracking.

Detection guidance

Monitor PowerFlex Manager logs for abnormal access patterns from low-privileged accounts, repeated failed operations, or service restarts that might indicate exploitation attempts. Watch for unusual API calls or CLI commands originating from authenticated sessions that do not correspond to legitimate administrative activities. Network-level monitoring should track unexpected traffic spikes or connection patterns targeting the PowerFlex Manager interface. Implement alerting on account lockouts or repeated authentication attempts using shared or service accounts, as these may precede exploitation.

Why prioritize this

Although not yet on the CISA KEV list, this vulnerability warrants near-term attention due to its HIGH severity rating, the low barrier to exploitation (any authenticated user), and the critical operational role of PowerFlex Manager in storage infrastructure. Organizations should treat this as a priority-high patch candidate within the next 30 days, balancing patch testing and validation against the moderate exploitability risk in the current threat landscape.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH severity issue: network-accessible, low-complexity attack requiring only low privileges, with no user interaction needed. The primary impact is denial of service (high availability impact), which directly affects business operations. While confidentiality and integrity are not compromised, the combination of easy exploitability, low privilege barrier, and operational impact justifies the HIGH rating. Organizations with mature patch management and network segmentation may temporarily accept this risk for a controlled patching cycle, but remediation should not be deferred beyond 60 days.

Frequently asked questions