CVE-2025-26330 Overview
CVE-2025-26330 is an incorrect authorization vulnerability [CWE-863] in Dell PowerScale OneFS, the operating system that powers Dell's scale-out NAS storage clusters. The flaw affects PowerScale OneFS versions 9.4.0.0 through 9.10.0.1. An unauthenticated attacker with local access can exploit this weakness to access the cluster using the previous privileges of a disabled user account. Dell published security advisory DSA-2025-119 addressing this issue along with other vulnerabilities in the same release.
Critical Impact
Successful exploitation grants attackers cluster access with the historical privileges of disabled accounts, undermining account deactivation as a security control.
Affected Products
- Dell PowerScale OneFS 9.4.0.0 through 9.10.0.1
- PowerScale and Isilon clusters running the affected OneFS releases
- Any storage environment relying on OneFS user account disablement as an access control
Discovery Timeline
- 2025-04-10 - CVE-2025-26330 published to NVD
- 2025-04-10 - Dell publishes security advisory DSA-2025-119
- 2025-07-15 - Last updated in NVD database
Technical Details for CVE-2025-26330
Vulnerability Analysis
The vulnerability stems from an authorization logic failure in PowerScale OneFS. When an administrator disables a user account, OneFS does not fully revoke the privileges previously associated with that account. An attacker who reaches the system through a local access path can leverage residual authorization state to access the cluster as the disabled identity.
This behavior contradicts the security expectation that disabling an account immediately invalidates its access rights. The weakness aligns with [CWE-863] Incorrect Authorization, where the application performs an authorization check but uses an incorrect outcome. Exploitation requires user interaction and high attack complexity, but yields high impact on confidentiality, integrity, and availability of the cluster.
Root Cause
The root cause is an incomplete authorization revocation flow in OneFS account management. Disabling a user account should remove all associated entitlements, sessions, and cached privileges. In affected versions, the disable operation leaves authorization artifacts intact, allowing a subsequent access attempt to inherit the disabled account's prior permissions.
Attack Vector
The attack requires local access to the PowerScale cluster and depends on conditions that involve user interaction. An unauthenticated attacker positioned with local access can trigger access paths that resolve against the residual authorization state of a previously disabled account. No verified public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Dell Security Update DSA-2025-119 for the authoritative technical context.
Detection Methods for CVE-2025-26330
Indicators of Compromise
- Successful authentication or session establishment associated with user accounts that were previously disabled in OneFS.
- Cluster operations performed under the identity of an account whose status is disabled in the OneFS user database.
- Audit log entries showing privilege use by an account after its disablement timestamp.
Detection Strategies
- Correlate OneFS authentication and audit logs against the account lifecycle database to flag activity by disabled identities.
- Establish detection rules that alert when any privileged action references a user whose state field is disabled.
- Review SSH, web administration, and API access logs on PowerScale nodes for sessions tied to deactivated accounts.
Monitoring Recommendations
- Forward OneFS audit logs, including isi audit protocol and configuration events, to a centralized SIEM for correlation.
- Track changes to user account state and alert when disabled accounts produce subsequent activity.
- Monitor cluster administrative interfaces for anomalous local access patterns and privilege use.
How to Mitigate CVE-2025-26330
Immediate Actions Required
- Apply the OneFS update referenced in Dell advisory DSA-2025-119 as the primary remediation.
- Inventory all PowerScale clusters running OneFS 9.4.0.0 through 9.10.0.1 and prioritize patch deployment.
- Audit the OneFS user database for disabled accounts and validate that no recent activity is associated with them.
Patch Information
Dell has released a fixed version of PowerScale OneFS addressing CVE-2025-26330. Customers should consult the Dell Security Update DSA-2025-119 for the exact fixed release and upgrade guidance applicable to their cluster version.
Workarounds
- Delete user accounts entirely instead of disabling them when offboarding is permanent, removing the residual authorization state.
- Restrict local and administrative access to PowerScale nodes to a minimal set of trusted operators while patching is scheduled.
- Enforce strict network segmentation around the storage management plane to limit local access opportunities.
# Configuration example: enumerate and review disabled accounts on OneFS
isi auth users list --enabled=false
# After offboarding, remove the account rather than leaving it disabled
isi auth users delete <username>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
