CVE-2026-26361: Dell Unisphere Information Disclosure

CVE-2026-26361 Overview

Dell Unisphere for PowerMax version 10.2 contains an External Control of File Name or Path vulnerability (CWE-73). A low-privileged attacker with remote access could potentially exploit this vulnerability to gain unauthorized access to sensitive information. This vulnerability allows attackers to manipulate file paths or filenames to access files outside the intended directory structure, leading to information disclosure.

Critical Impact

Authenticated attackers can exploit path manipulation to access sensitive configuration files, credentials, or other confidential data stored on affected Dell Unisphere for PowerMax systems.

Affected Products

• Dell Unisphere for PowerMax version 10.2
• Dell PowerMax EEM (related security update)

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-26361 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26361

Vulnerability Analysis

This vulnerability falls under CWE-73 (External Control of File Name or Path), which occurs when software allows user input to control or influence file system paths used in operations. In the context of Dell Unisphere for PowerMax, the application fails to properly validate or sanitize user-supplied input that is used to construct file paths.

The vulnerability is network-accessible and requires only low privileges to exploit. No user interaction is required for successful exploitation. While the vulnerability has high impact on confidentiality, it does not affect system integrity or availability. The scope is unchanged, meaning the vulnerable component and impacted component are the same.

Root Cause

The root cause of this vulnerability is improper input validation in Dell Unisphere for PowerMax version 10.2. The application does not adequately sanitize user-controlled input before using it to construct file paths. This allows attackers to inject path traversal sequences or manipulate filenames to access files outside the intended directory boundaries.

External Control of File Name or Path vulnerabilities typically occur when:

• User input is directly concatenated into file paths without sanitization
• Path traversal sequences like ../ are not filtered
• Symbolic links are followed without proper validation
• File operations do not enforce proper access controls

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated remote access to the Dell Unisphere for PowerMax management interface. With low-privilege credentials, an attacker can craft malicious requests containing specially crafted file path parameters.

The attacker manipulates file path parameters in API requests or web interface interactions to traverse directories and access sensitive files. This could expose configuration files, system information, credentials, or other sensitive data stored on the system.

Detection Methods for CVE-2026-26361

Indicators of Compromise

• Unusual file access patterns in Dell Unisphere for PowerMax logs, particularly requests containing path traversal sequences (../, ..\\)
• Low-privileged user accounts accessing files outside their normal operational scope
• HTTP requests to the management interface containing encoded path traversal characters (%2e%2e%2f, %252e%252e%252f)
• Unexpected access to configuration files or sensitive directories from web application processes

Detection Strategies

• Monitor web server access logs for requests containing path traversal patterns such as ../, ..\\, or URL-encoded equivalents
• Implement file integrity monitoring on sensitive configuration directories to detect unauthorized access attempts
• Configure SIEM rules to alert on anomalous file access patterns from the Unisphere application service account
• Review authentication logs for suspicious activity from low-privileged accounts attempting to access restricted resources

Monitoring Recommendations

• Enable detailed audit logging for file system access on Dell Unisphere for PowerMax servers
• Deploy network-based intrusion detection systems (IDS) with signatures for path traversal attack patterns
• Implement application-layer logging to capture all file path parameters in requests
• Establish baseline file access patterns and alert on deviations indicating potential exploitation attempts

How to Mitigate CVE-2026-26361

Immediate Actions Required

• Apply the security update from Dell as documented in Dell Security Advisory DSA-2026-102
• Review access logs for signs of exploitation prior to patching
• Restrict network access to the Dell Unisphere for PowerMax management interface to trusted IP addresses only
• Ensure user accounts have minimum necessary privileges and audit existing account permissions

Patch Information

Dell has released a security update addressing this vulnerability. Detailed patch information and download links are available in Dell Security Advisory DSA-2026-102. Organizations should prioritize applying this update to all affected Dell Unisphere for PowerMax version 10.2 installations.

Workarounds

• Implement network segmentation to restrict access to the Dell Unisphere for PowerMax management interface from untrusted networks
• Deploy a web application firewall (WAF) with rules to block path traversal attempts targeting the management interface
• Review and restrict user privileges to minimize the potential impact of exploitation
• If immediate patching is not possible, consider temporarily restricting remote access to the management interface until the patch can be applied