Introduction
Any unauthenticated attacker on the management network segment can invoke a critical management function in Dell PowerFlex Manager. The attack needs no credentials, no user interaction, and no special conditions. PowerFlex Manager is the orchestration layer for Dell's software-defined storage platform, which can scale to over 2,000 nodes and 240 million IOPS. That means this missing-authentication flaw (CVE-2026-35065, CVSS 8.8) effectively hands an adjacent attacker the command-and-control channel for the entire storage cluster.
Dell PowerFlex, formerly known as ScaleIO and VxFlex OS, is a commercial software-defined storage product that pools direct-attached storage from x86 servers into shared block storage over IP networks. It runs in enterprise environments on VMware, Hyper-V, Xen, and KVM, and supports high-performance workloads, including Oracle databases. PowerFlex Manager provides the UI and REST API for lifecycle management of PowerFlex rack and appliance deployments, which makes it the single pane of glass for cluster operations.
Technical information
Root cause: CWE-306 Missing Authentication for Critical Function
CVE-2026-35065 falls under CWE-306. That weakness covers software that performs a critical function, meaning one that uses significant system resources or modifies privileged state, without authenticating the caller. As MITRE documents it, any attacker who can reach such a function inherits that function's privilege level. The typical technical outcomes are reading or modifying sensitive data, gaining administrative privileges, and arbitrary code execution.
MITRE identifies two recurring root causes for CWE-306: security tactics left out during architecture and design, and a secondary channel that was assumed to be private but that attackers can reach. The second pattern, which treats "internal network only" as if it meant "authentication not required," is a recurring antipattern in management appliances. It matches the Adjacent attack vector on this advisory precisely.
What PowerFlex Manager controls
PowerFlex Manager hosts the cluster user interface and the REST API for lifecycle management of PowerFlex rack and appliance deployments. It is the orchestration layer for the entire storage infrastructure. With authentication missing on this component, an attacker can interact with cluster management operations, including deployment, configuration, and potentially destructive actions, without ever presenting credentials.
CVSS vector decomposition
The 8.8 base score comes from the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Each metric has a specific operational meaning:
| Metric | Value | Operational meaning |
|---|---|---|
| Attack Vector (AV) | Adjacent | Attacker must be on the same logical segment as the management plane |
| Attack Complexity (AC) | Low | No special conditions, no race, no configuration prerequisite |
| Privileges Required (PR) | None | No credential of any kind is required |
| User Interaction (UI) | None | No user needs to be tricked |
| Scope (S) | Unchanged | Impact stays inside the vulnerable component boundary |
| Confidentiality (C) | High | Total disclosure of managed resources |
| Integrity (I) | High | Total modification of managed resources |
| Availability (A) | High | Total disruption of managed services |
The Adjacent vector, rather than Network, is the only metric keeping this from reaching CVSS 9.0+. In practice, "adjacent" means the PowerFlex management VLAN.
Attack surface and exploitation flow
Dell's architectural guidance places PowerFlex Manager inside a dedicated "Management control plane" on a "PowerFlex management cluster," reached through dedicated management switches (for example, Dell PowerSwitch S3248T-ON). So the "adjacent network access" requirement means the management VLAN, not the data VLAN.
The likely exploitation flow runs in four steps:
- The attacker gets a foothold on the management VLAN, for example through a compromised administrator jump box, a mis-deployed VM routed onto the management segment, a second-tier operator subnet, or a malicious insider.
- The attacker identifies the PowerFlex Manager instance and its exposed API or UI endpoints.
- The attacker invokes the unauthenticated critical function directly, without presenting any credentials.
- Because the function runs at the manager's privilege level, the attacker can execute code, modify cluster configuration, exfiltrate data, inject scripts, or disrupt storage services across the entire PowerFlex deployment.
Dell's published impact list confirms this breadth: code execution, denial of service, information disclosure, information tampering, remote execution, script injection, and unauthorized access.
Why "adjacent only" is less reassuring than it sounds
The AV:A vector is often treated as a significant mitigating factor, but in real PowerFlex deployments the management VLAN is reachable from multiple trust boundaries. Any operator-tier foothold already on the management VLAN qualifies, including a legitimate but compromised administrator jump box or a tenant VM mis-routed onto the management segment. In hyper-converged PowerFlex configurations, where SDS and SDC are co-located, the management plane may share physical infrastructure with compute workloads, which lowers the effective barrier to adjacency further.
Patch information
Dell has addressed CVE-2026-35065 in security advisory DSA-2026-066, released on June 15, 2026. The fix ships as a software upgrade to the PowerFlex Software bundle, which includes the PowerFlex Manager component where the flaw lives.
The core of the patch enforces authentication on the critical function in PowerFlex Manager that unauthenticated users on the adjacent network could previously reach.
Dell provides remediated versions on two supported release branches:
- 5.x branch: Upgrade to Version 5.1.0.1 or later
- 4.x branch: Upgrade to Version 4.5.5.2 or later
Organizations running a PowerFlex Software version earlier than the fixed release on their branch are affected and must upgrade. Updated packages are available through the Dell RCM release portal. For manual upgrade paths, Dell points administrators to the PowerFlex (ScaleIO) Drivers and Downloads page.
The advisory also bundles fixes for several other proprietary-code vulnerabilities, plus third-party component CVEs, all resolved in the same upgrade:
- SQL injection flaws: CVE-2026-35069, CVE-2026-35068
- Improper access control issues: CVE-2026-35066, CVE-2026-35067 (CVSS 5.7), CVE-2026-35162 (CVSS 4.3)
- Improper authentication bugs: CVE-2026-32804 (CVSS 8.1), CVE-2026-49502 (CVSS 7.4)
- Broken cryptographic algorithm: CVE-2026-40641
- Third-party component CVEs in Kernel, urllib3, and Keycloak
One upgrade pass covers the entire batch. Dell credits security researcher brocked200 with reporting CVE-2026-35065 and several of the sibling CVEs.
DSA-2026-066 publishes no configuration workaround, firewall allowlist recipe, or temporary patch. The software upgrade is the only remedy Dell prescribes.
For defense in depth while planning the upgrade, operators should consider these compensating controls, drawn from CWE-306 guidance and PowerFlex architecture documentation:
- Restrict the management plane with tighter ACLs at the network layer, so that only administrators on the designated management VLAN, or connecting through a bastion host with MFA, can reach the manager.
- Put SSO or IdP-mediated access in front of the PowerFlex Manager UI and API instead of relying only on local authentication.
- Monitor for unexpected access patterns, including unauthenticated HTTP requests to manager API paths, repeated error responses, and cluster configuration changes with no matching credentialed audit event.
After upgrading, verify that the running PowerFlex Software version is at least 5.1.0.1 or 4.5.5.2, depending on the branch. Then confirm that every manager function path now requires authentication and that audit logging captures every invocation.
Affected systems and versions
The following PowerFlex Software versions are affected:
- 5.x branch: All versions before 5.1.0.1
- 4.x branch: All versions before 4.5.5.2
The vulnerable component is PowerFlex Manager, the management and orchestration layer within the broader PowerFlex Software bundle. Both hyper-converged (HCI) configurations, where SDS and SDC are co-located, and two-layer configurations, where they are separate, are affected when running a vulnerable version.
Vendor security history
Dell's PowerFlex product line has a documented history of management-plane vulnerabilities. Earlier CVEs affecting PowerFlex Manager include:
- CVE-2025-32750: Directory listing exposure in PowerFlex Manager versions prior to 4.6.3, rated CVSS 7.5
- CVE-2025-32751: Information disclosure vulnerability in PowerFlex Manager
- CVE-2025-32746: Information disclosure vulnerability in PowerFlex Manager
Outside PowerFlex, Dell's broader enterprise appliance line has had significant security events in 2026. The most notable is CVE-2026-22769, a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines that the PRC-linked threat cluster UNC6201 had exploited as a zero day since mid-2024. Google's threat intelligence team documented the actor using this vulnerability to deliver the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell. CISA added CVE-2026-22769 to the KEV catalog on February 18, 2026.
Dell has issued numerous security advisories across its product families in 2026, including DSA-2026-060 (PowerProtect Data Domain), DSA-2026-136 (PowerEdge OpenSSL), DSA-2026-140 (Dell Networking rsync), DSA-2026-143 (ObjectScale log file), and DSA-2026-193 (Automation Platform). The Canadian Centre for Cyber Security independently republishes Dell advisories (e.g., AV26-138, AV26-203), a sign of sustained attention from national cybersecurity agencies.
Dell Technologies publicly launched a 2026 expansion of its security-by-design and cyber-resilience product narrative, but the practitioner takeaway is the same as before. The practical security posture of a Dell enterprise appliance is set by the operator's patch cadence and management-plane segmentation. Vendor marketing does not set it.
References
- CVE-2026-35065 Detail, NVD
- DSA-2026-066: Security Update for PowerFlex Software Multiple Vulnerabilities
- CWE-306: Missing Authentication for Critical Function
- Dell Security Advisories, Notices and Resources
- PowerFlex Manager API, Dell Technologies Info Hub
- Dell PowerFlex Rack with PowerFlex 4.x Architecture Overview
- Dell Technologies PowerFlex, Wikipedia
- CISA Known Exploited Vulnerabilities Catalog
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (Feb 18, 2026)
- UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero Day, Google Cloud Blog
- China linked hackers exploited Dell zero day since 2024, Help Net Security
- Dell RecoverPoint Zero Day Exploited by Chinese Cyberespionage Group, SecurityWeek
- CVE-2026-22769 Detail, NVD
- CVE-2025-32751: Dell PowerFlex Information Disclosure, SentinelOne
- CVE-2025-32750, PowerFlex Manager, PT Security
- Dell PowerFlex Manager Vulnerabilities, Radical Notion
- Dell security advisory AV26-203, Canadian Centre for Cyber Security
