CVE-2026-23773: Dell Disk Library SSRF Vulnerability

CVE-2026-23773 Overview

Dell Disk Library for Mainframe (DLm) versions 8700/2700 contain a Server-Side Request Forgery (SSRF) vulnerability. This security flaw allows a low privileged attacker with remote network access to potentially exploit the vulnerability, enabling unauthorized server-side requests. SSRF vulnerabilities can allow attackers to make requests from the vulnerable server to internal resources that would otherwise be inaccessible from external networks.

Critical Impact

A low privileged attacker could leverage this SSRF vulnerability to probe internal network resources, access internal services, or potentially pivot to other systems within the network infrastructure.

Affected Products

• Dell Disk Library for Mainframe DLm 8700
• Dell Disk Library for Mainframe DLm 2700

Discovery Timeline

• April 29, 2026 - CVE-2026-23773 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23773

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in Dell Disk Library for Mainframe allows authenticated attackers to manipulate the server into making requests to arbitrary destinations. The vulnerability requires low privileges and can be exploited remotely over the network without user interaction.

SSRF vulnerabilities occur when an application fetches a remote resource without properly validating the user-supplied URL. In this case, the Dell DLm appliance processes user-controlled input that specifies a URL or network location, and the server makes requests to that location on behalf of the attacker.

The confidentiality impact is limited, as the vulnerability primarily enables information disclosure from internal network resources. There is no direct integrity or availability impact associated with this vulnerability.

Root Cause

The root cause of this vulnerability is improper validation of user-supplied input that is used to construct server-side requests. The Dell Disk Library for Mainframe fails to adequately validate, filter, or sanitize URL parameters or destination addresses before the server processes the request. This allows attackers to specify arbitrary internal or external destinations for the server to access.

Attack Vector

The attack vector is network-based, requiring the attacker to have low-level authenticated access to the Dell Disk Library for Mainframe management interface. The attacker can craft malicious requests that cause the DLm appliance to:

1. Make requests to internal network services not normally accessible from external networks
2. Probe internal IP ranges and ports to map the internal network topology
3. Access cloud metadata services if the appliance is deployed in a cloud environment
4. Potentially retrieve sensitive information from internal services that trust requests originating from the DLm appliance

The vulnerability can be exploited by submitting specially crafted requests through the DLm web interface or API endpoints that accept URL parameters. The server then processes these requests and returns responses to the attacker, effectively acting as a proxy to internal resources.

Detection Methods for CVE-2026-23773

Indicators of Compromise

• Unusual outbound network connections from the Dell DLm appliance to internal IP addresses or unexpected external destinations
• Anomalous access patterns to internal services originating from the DLm system
• Unexpected DNS lookups or connection attempts to cloud metadata services (e.g., 169.254.169.254)
• Increased volume of requests to the DLm web interface containing URL parameters with internal network addresses

Detection Strategies

• Monitor Dell DLm appliance network traffic for connections to internal resources that are outside normal operational patterns
• Implement network segmentation monitoring to detect lateral movement attempts originating from the DLm system
• Review DLm application logs for requests containing suspicious URL parameters or internal IP addresses
• Deploy intrusion detection rules to identify SSRF exploitation patterns targeting the DLm appliance

Monitoring Recommendations

• Enable comprehensive logging on the Dell Disk Library for Mainframe management interface
• Configure network monitoring to alert on unusual traffic patterns from the DLm appliance to internal network segments
• Implement application-level logging to capture all URL parameters processed by the DLm system
• Set up alerts for access attempts to sensitive internal services from the DLm appliance IP address

How to Mitigate CVE-2026-23773

Immediate Actions Required

• Apply the security update provided by Dell as documented in Dell Security Advisory DSA-2026-091
• Restrict network access to the Dell DLm management interface to authorized administrators only
• Implement network segmentation to limit the DLm appliance's ability to reach sensitive internal resources
• Review and audit user accounts with access to the DLm system, removing unnecessary privileges

Patch Information

Dell has released a security update to address this vulnerability. Administrators should consult the Dell Security Advisory DSA-2026-091 for detailed patch information and upgrade instructions for Dell Disk Library for Mainframe DLm 8700 and DLm 2700 systems.

Workarounds

• Implement strict firewall rules to limit outbound connections from the Dell DLm appliance to only required destinations
• Deploy a web application firewall (WAF) in front of the DLm management interface to filter malicious requests
• Use network access control lists to prevent the DLm appliance from accessing sensitive internal services
• Consider placing the DLm management interface on an isolated management network with limited connectivity to production systems

# Example firewall rules to restrict DLm outbound connections
# Adjust IP addresses and ports according to your environment

# Allow only necessary outbound connections from DLm appliance
iptables -A OUTPUT -s <DLm_IP> -d <allowed_destination> -p tcp --dport <required_port> -j ACCEPT
iptables -A OUTPUT -s <DLm_IP> -j DROP

# Block access to cloud metadata services
iptables -A OUTPUT -s <DLm_IP> -d 169.254.169.254 -j DROP