CVE-2026-35069: Dell PowerFlex Manager SQL Injection Vulnerability – Remediation Guide

Technical summary

CVE-2026-35069 is a SQL injection vulnerability (CWE-89) in Dell PowerFlex Manager affecting versions prior to 5.1.0.1. The flaw exists in a component that fails to properly sanitize or parameterize user-controlled input before constructing SQL queries. An adjacent-network attacker with low-privilege credentials can craft malicious SQL payloads to break out of intended query logic and execute arbitrary SQL commands. This can lead to script injection, potentially allowing retrieval or manipulation of sensitive data, authentication bypass, or lateral movement within the PowerFlex infrastructure. The CVSS 3.1 score of 5.7 (MEDIUM) reflects the requirement for authentication and adjacent network access, but the high confidentiality impact indicates that successful exploitation exposes sensitive information.

Business impact

PowerFlex Manager handles storage infrastructure orchestration and configuration in Dell enterprise environments. A successful SQL injection attack could allow an insider or adjacent-network attacker to exfiltrate storage credentials, access management metadata, or manipulate storage policies. In multi-tenant or highly regulated environments, unauthorized data access could trigger compliance violations and customer notifications. The attack also creates a stepping stone for lateral movement into the broader storage fabric. While the immediate blast radius is constrained by network proximity and authentication requirements, the sensitivity of storage management systems elevates business risk beyond the base CVSS score.

Affected systems

Dell PowerFlex Manager versions prior to 5.1.0.1 are affected. Organizations running PowerFlex Manager should verify their installed version immediately. The vulnerability does not affect later versions; verify against the vendor advisory for precise version boundaries and any interim patches applied to your deployment.

Exploitability

Exploitation requires adjacent network access and valid low-privilege credentials—not internet-reachable attack surface. This significantly reduces drive-by exploitation risk but elevates risk for disgruntled employees or lateral movement by an attacker already inside the network perimeter. The CVSS vector (AV:A/PR:L/AC:L) indicates adjacent scope and low complexity, meaning once an attacker has network access and credentials, the attack is straightforward to execute. No public exploit code or widespread weaponization has been reported, and the vulnerability is not on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Dell PowerFlex Manager to version 5.1.0.1 or later. If immediate patching is not feasible, restrict network access to PowerFlex Manager administrative interfaces to trusted networks and enforce strong authentication policies (MFA where possible). Review access logs for any signs of suspicious SQL queries or unusual administrative activity.

Patch guidance

Dell has released version 5.1.0.1 or later to address this vulnerability. Verify the exact version number against the Dell security advisory for your specific PowerFlex deployment. Test patches in a non-production environment before rolling out to production management clusters to ensure compatibility with your storage infrastructure. Plan patching during a maintenance window to minimize operational disruption to storage services.

Detection guidance

Monitor PowerFlex Manager logs for SQL syntax errors, unusual query patterns, or failed SQL statements—signs of injection attempts. Look for abnormal database connection behavior, unexpected credential access, or authentication anomalies in administrative access logs. If your environment supports it, enable SQL query auditing to capture full command text. Network-based detection should focus on adjacent-network traffic to PowerFlex Manager ports for suspicious payloads containing SQL keywords or special characters.

Why prioritize this

Although the CVSS score is MEDIUM (5.7), prioritize this vulnerability for organizations with PowerFlex Manager in production. The high confidentiality impact and the sensitive nature of storage management systems justify urgent attention. The authentication and adjacency requirements reduce external risk, but the ease of exploitation (low AC) and potential for insider threats argue for swift patching. Organizations should treat this as a high-priority internal infrastructure security issue.

Risk score, explained

CVSS 3.1 score of 5.7 (MEDIUM) is driven by: high confidentiality impact (C:H) reflecting potential unauthorized access to sensitive storage data; adjacent network requirement (AV:A) limiting exposure to internal or same-network attackers; low-privilege authentication requirement (PR:L) narrowing the attacker pool; and low attack complexity (AC:L) indicating straightforward exploitation once prerequisites are met. No integrity or availability impact is scored, but script injection could enable secondary attacks. The score appropriately reflects a significant but not critical risk for networked deployments.

Frequently asked questions