CVE-2026-35068: Dell PowerFlex Manager SQL Injection Vulnerability – Security Analysis

Technical summary

CVE-2026-35068 is a CWE-89 SQL injection flaw in Dell PowerFlex Manager's input handling. The vulnerability exists in versions prior to 5.1.0.1 and requires low-level privileges and adjacent network access. An attacker can craft malicious SQL queries through unvalidated input parameters to access unauthorized database records. The CVSS 3.1 score of 3.5 (LOW) reflects the requirement for authentication and network proximity, though the confidentiality impact is present.

Business impact

For organizations running PowerFlex storage infrastructure, this vulnerability poses a targeted information disclosure risk. An internal user or lateral movement threat actor could potentially access sensitive storage configuration, performance metrics, or administrative credentials stored in the PowerFlex Manager database without elevated privileges. Breach of these details could facilitate further attacks on the storage fabric or expose business-critical data paths. However, the requirement for valid credentials and local network access limits exposure to external, unauthenticated threat actors.

Affected systems

Dell PowerFlex Manager versions prior to 5.1.0.1 are affected. Organizations should verify their exact version number in the PowerFlex Manager administrative interface. Deployments on older versions require immediate attention, particularly in environments where storage administrators or support staff have standard-user network access to the management plane.

Exploitability

Exploitation requires three conditions: valid user credentials, adjacency to the management network, and knowledge of vulnerable input parameters. There is no public exploit code listed in known-exploited vulnerability catalogs. The low CVSS score reflects these barriers, but the ease of crafting SQL injection payloads once access is gained means that any authenticated account with network connectivity poses a realistic threat vector in environments with weak privilege separation.

Remediation

Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later. Organizations unable to patch immediately should restrict network access to the PowerFlex Manager service, enforce strong authentication policies, and monitor database query logs for suspicious SQL patterns. Consider implementing network segmentation to limit which accounts can reach the management interface.

Patch guidance

Download and deploy Dell PowerFlex Manager 5.1.0.1 or the latest available patch from Dell's support portal. Verify the version string after deployment and validate that database query logging remains enabled post-upgrade to detect any exploitation attempts that may have occurred. Consult the official Dell advisory for any service interruption considerations during the upgrade.

Detection guidance

Monitor PowerFlex Manager database logs for unusual SQL queries, especially those containing SQL metacharacters (single quotes, semicolons, UNION operators) in input parameters. Check for failed authentication attempts or privilege escalations involving storage users. Network monitoring can flag abnormal traffic patterns between client machines and the PowerFlex Manager database port. Enable detailed audit logging on the management appliance if not already active.

Why prioritize this

Despite the LOW CVSS score, this vulnerability merits prompt attention in storage-centric environments because it enables unauthorized data access within a trusted network segment. The flaw is straightforward to exploit once prerequisites are met, and PowerFlex deployments often contain security-sensitive configuration and performance data. Prioritize remediation in organizations with strict data protection requirements or where storage credentials are reused across systems.

Risk score, explained

The CVSS 3.1 score of 3.5 reflects a confidentiality-only impact with significant access barriers: authentication required (PR:L), local network adjacency (AV:A), and no user interaction needed. The low severity is justified because exterior attackers cannot reach the vulnerability and unauthorized data disclosure alone does not compromise the storage infrastructure's availability or integrity. However, the information disclosed could enable lateral movement or policy violations, warranting faster remediation than the score alone might suggest.

Frequently asked questions