CVE-2026-32802: Dell PowerPath Privilege Escalation Flaw

CVE-2026-32802 Overview

CVE-2026-32802 is an Improper Privilege Management vulnerability [CWE-269] affecting Dell PowerPath for Windows, versions 7.2 through 8.0 SP1. A locally authenticated attacker with low privileges can exploit the flaw to elevate privileges on the affected host. Dell addressed the issue in security advisory DSA-2026-167.

The vulnerability requires local access and low privileges, with no user interaction. Successful exploitation yields limited impact to confidentiality, integrity, and availability, according to the published CVSS vector. There is no public proof-of-concept and the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Critical Impact
Authenticated local users on Windows hosts running Dell PowerPath 7.2 through 8.0 SP1 can elevate privileges, expanding access beyond their assigned role.

Affected Products

Dell PowerPath for Windows 7.2
Dell PowerPath for Windows 8.0
Dell PowerPath for Windows 8.0 SP1

Discovery Timeline

2026-08-19 - CVE-2026-32802 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-32802

Vulnerability Analysis

Dell PowerPath is a host-based multipathing driver and management stack that manages I/O paths between Windows servers and storage arrays. The product installs privileged Windows services and drivers that interact with kernel-mode components and local configuration files. Improper Privilege Management [CWE-269] in this context means a component grants or inherits more privileges than the calling user should possess.

A low-privileged local user interacting with an affected PowerPath component can leverage this weakness to perform actions in a higher-privileged security context. The CVSS impact metrics indicate partial compromise of confidentiality, integrity, and availability rather than full system takeover. Exploitation is constrained to attackers who already hold local, authenticated access to the Windows host.

Root Cause

The root cause is improper enforcement of privilege boundaries within a Dell PowerPath component on Windows. Dell has not published the specific binary or interface at fault; refer to Dell Security Update DSA-2026-167 for vendor-supplied technical detail.

Attack Vector

The attack vector is local. An attacker must first obtain interactive or programmatic access to a Windows host running an affected PowerPath version as a low-privileged user. From that context, the attacker interacts with the vulnerable PowerPath component to gain elevated privileges. No user interaction from another party is required, and the attack complexity is low.

No verified public exploit is available for CVE-2026-32802. See the Dell advisory referenced above for authoritative technical guidance.

Detection Methods for CVE-2026-32802

Indicators of Compromise

Unexpected child processes spawned by PowerPath services (emcpmgr.exe, PowerPathAdmin, and related binaries) running as SYSTEM.
Modification of PowerPath configuration files or registry keys by non-administrative accounts.
New local administrator accounts or group membership changes on hosts running PowerPath.

Detection Strategies

Inventory Windows hosts to identify PowerPath installations at versions 7.2 through 8.0 SP1 using software asset management data.
Alert on low-privileged users invoking PowerPath command-line utilities followed by privilege changes on the same host within a short window.
Correlate Windows Security event IDs 4672 and 4673 (special privileges assigned) with process creation events tied to PowerPath binaries.

Monitoring Recommendations

Enable Windows process creation auditing (event ID 4688) with command-line logging on all PowerPath hosts.
Forward endpoint telemetry, Sysmon events, and Windows Security logs to a centralized SIEM for cross-host correlation.
Monitor file and registry ACL changes under the PowerPath installation path for tampering by non-privileged accounts.

How to Mitigate CVE-2026-32802

Immediate Actions Required

Identify all Windows systems running Dell PowerPath 7.2 through 8.0 SP1 and prioritize them for patching.
Apply the fixed release referenced in Dell advisory DSA-2026-167 following Dell's upgrade procedure for PowerPath.
Restrict interactive and remote logon rights on hosts running PowerPath to trusted administrative personnel only.

Patch Information

Dell has published remediation in Dell Security Update DSA-2026-167. Administrators should review the advisory for the specific fixed version and follow Dell's documented upgrade path for PowerPath for Windows.

Workarounds

Enforce least-privilege access on Windows hosts hosting PowerPath, removing unnecessary local user accounts.
Apply application allow-listing to prevent unauthorized execution of tools that interact with PowerPath services.
Audit and tighten NTFS and registry permissions on PowerPath installation directories to block modification by non-administrators.

bash

# Configuration example: enumerate PowerPath version on Windows hosts via PowerShell remoting
Invoke-Command -ComputerName (Get-Content .\hosts.txt) -ScriptBlock {
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' |
        Where-Object { $_.DisplayName -like 'EMC PowerPath*' -or $_.DisplayName -like 'Dell PowerPath*' } |
        Select-Object PSComputerName, DisplayName, DisplayVersion, InstallDate
}