CVE-2026-35067: Dell PowerFlex Manager Privilege Escalation Vulnerability

Technical summary

CVE-2026-35067 is an improper access control vulnerability (CWE-284) in Dell PowerFlex Manager affecting versions prior to 5.1.0.1. The vulnerability allows a low-privileged, authenticated attacker with adjacent network access to bypass authorization controls and escalate privileges or gain unauthorized information disclosure. The CVSS 3.1 score of 5.7 (MEDIUM) reflects local/adjacent network attack surface, low complexity, requirement for low privilege level, and high confidentiality impact without integrity or availability impact.

Business impact

If exploited, this vulnerability could enable insider threats or compromised user accounts to escalate to storage administrator roles within PowerFlex Manager, potentially exposing block storage configurations, performance data, or enabling unauthorized modifications to storage policies. For organizations running Dell PowerFlex infrastructure, this represents a lateral movement risk post-breach and could complicate compliance audits if administrative activity logs are accessed by unauthorized users.

Affected systems

Dell PowerFlex Manager versions prior to 5.1.0.1 are affected. Organizations should identify all instances of PowerFlex Manager in their environment and compare against the patched version threshold. This includes both on-premises and hybrid deployments using affected version lines.

Exploitability

Exploitation requires three conditions: (1) the attacker must already possess valid user credentials and be authenticated, (2) the attacker must have network connectivity to the PowerFlex Manager instance (adjacent network access), and (3) the target system must be running an unpatched version prior to 5.1.0.1. This is not a remote unauthenticated attack. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting in-the-wild exploitation has not yet been publicly documented.

Remediation

Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later. Before upgrading, review Dell's official security advisory and patch release notes to understand any configuration changes, compatibility notes, or pre-upgrade validation steps. Test patches in a non-production environment that mirrors your storage configuration. Plan maintenance windows in coordination with storage operations teams.

Patch guidance

Contact Dell Support or consult Dell's security advisories for the specific upgrade path for your PowerFlex Manager deployment. Verify the exact version number of your current installation through the management console or administrative interface. Dell may provide staged releases or phased deployment guidance; follow their recommended sequence. After patching, confirm the new version number is reflected in system information and run any post-upgrade validation tests to ensure storage services remain operational.

Detection guidance

Monitor PowerFlex Manager access logs for: (1) failed authentication attempts from internal network addresses, (2) privilege escalation events (users transitioning from standard to admin roles without corresponding administrative requests), (3) access to sensitive configuration endpoints by low-privileged accounts, and (4) anomalous API calls from authenticated sessions with atypical behavior patterns. Enable detailed audit logging if not already active, and correlate PowerFlex logs with identity and access management (IAM) systems to detect compromised credentials being used against storage infrastructure.

Why prioritize this

Although the CVSS score is moderate (5.7), this vulnerability poses meaningful risk in environments where PowerFlex Manager is critical to storage availability and where internal threat vectors are realistic (e.g., after ransomware compromise or employee departure scenarios). The requirement for valid credentials and adjacent access limits broad attack surface, but insider or lateral-movement exploits are plausible. Prioritize based on: (1) whether your PowerFlex Manager is internet-accessible or only internal, (2) the sensitivity of data stored on managed arrays, (3) the number of users with credentials to the system, and (4) your organization's maturity in detecting lateral movement.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects a low overall attack complexity and low privilege requirement, but factors in the requirement for adjacent network access (not remote exploitable) and lack of availability or integrity impact—only confidentiality is affected. This scoring appropriately signals that while the vulnerability is not critical, it is material enough to warrant timely patching, particularly for organizations with sensitive storage environments or strict data governance requirements.

Frequently asked questions