CVE-2026-32803: Dell PowerScale OneFS Disclosure Flaw

CVE-2026-32803 Overview

CVE-2026-32803 is an insufficient logging vulnerability [CWE-778] in Dell PowerScale OneFS. The flaw affects OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5, and 9.11.0.0 through 9.12.0.1. A low-privileged attacker with local access can exploit this weakness to tamper with information without leaving sufficient audit traces. Dell published the fix in advisory DSA-2026-172.

Critical Impact

A local, authenticated attacker can perform actions on the cluster that escape adequate logging, undermining incident response and forensic reconstruction on affected OneFS storage nodes.

Affected Products

• Dell PowerScale OneFS 9.5.0.0 – 9.5.1.6
• Dell PowerScale OneFS 9.6.0.0 – 9.7.1.13
• Dell PowerScale OneFS 9.8.0.0 – 9.10.1.5 and 9.11.0.0 – 9.12.0.1

Discovery Timeline

• 2026-05-08 - CVE CVE-2026-32803 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-32803

Vulnerability Analysis

The vulnerability is classified under [CWE-778] Insufficient Logging. PowerScale OneFS does not record adequate audit events for certain actions available to authenticated, low-privileged local users. When those actions occur, security-relevant evidence is missing from the audit trail. This weakens the ability of administrators and downstream monitoring tools to reconstruct activity on the cluster.

The issue does not expose data confidentiality directly. Instead, it creates conditions for information tampering because operations that should be reviewable are not adequately journaled. Investigators relying on OneFS audit data may miss attacker actions or be unable to attribute changes to a specific principal.

Root Cause

The root cause is missing or incomplete audit instrumentation in specific OneFS code paths. Events that change cluster or filesystem state are not logged with the fidelity required for security monitoring. Dell addresses the gap in DSA-2026-172 by adding the missing logging coverage.

Attack Vector

Exploitation requires local access and an authenticated, low-privileged account on the OneFS cluster. No user interaction is required. After authenticating, the attacker performs actions whose execution is not properly captured in the audit log, then alters or hides information without producing the expected forensic artifacts. No public proof-of-concept or exploit code is available for this issue.

Detection Methods for CVE-2026-32803

Indicators of Compromise

• Gaps or discontinuities in OneFS audit and protocol audit logs around windows of administrative activity.
• Filesystem or configuration changes whose origin cannot be correlated to a logged user action.
• Local sessions from low-privileged accounts that perform state-changing operations without matching audit entries.

Detection Strategies

• Forward OneFS audit and CEE (Common Event Enabler) streams to a centralized SIEM and alert on missing expected event types per session.
• Baseline expected event volumes per user role and flag sessions whose action count exceeds logged event count.
• Correlate authentication events with subsequent configuration or data-modification events to surface unaccounted activity.

Monitoring Recommendations

• Enable both configuration auditing and protocol auditing on every access zone where sensitive data resides.
• Retain OneFS audit data off-cluster to prevent local tampering and to support long-window forensics.
• Review privileged role assignments quarterly to minimize the number of accounts that can exercise affected code paths.

How to Mitigate CVE-2026-32803

Immediate Actions Required

• Inventory OneFS clusters and identify nodes running versions in the affected ranges listed in Dell Security Update DSA-2026-172.
• Apply the OneFS update referenced in DSA-2026-172 following Dell's upgrade guidance for your release line.
• Restrict local and management-plane access to OneFS to a small set of named administrators.

Patch Information

Dell published Dell Security Update DSA-2026-172 with fixed releases that add the missing audit coverage. Upgrade each affected version family to the corresponding patched release identified in the advisory. Verify the new build with isi version after the upgrade completes.

Workarounds

• No vendor-supplied workaround removes the logging gap. Upgrading is the only complete remediation.
• As compensating controls, tighten role-based access on the cluster and increase external monitoring of administrative sessions until patches are deployed.
• Ship audit data continuously to an external collector so that any remaining local logs cannot be the sole source of truth.

# Verify the installed OneFS version against the fixed releases in DSA-2026-172
isi version

# Confirm auditing is enabled for configuration and protocol events
isi audit settings global view
isi audit settings view --zone=System