CVE-2026-35065: Dell PowerFlex Auth Bypass Vulnerability

CVE-2026-35065 Overview

CVE-2026-35065 is a Missing Authentication for Critical Function vulnerability [CWE-306] affecting Dell PowerFlex Manager. The flaw allows an unauthenticated attacker with adjacent network access to invoke critical functionality without providing credentials. Successful exploitation can lead to code execution, denial of service, information disclosure, information tampering, remote execution, script injection, and unauthorized access to the management plane.

Dell published security advisory DSA-2026-066 to address multiple vulnerabilities in PowerFlex software, including this issue. The vulnerability impacts the confidentiality, integrity, and availability of PowerFlex-managed storage infrastructure.

Critical Impact
An unauthenticated attacker on an adjacent network can execute code, tamper with data, and disrupt service on Dell PowerFlex Manager deployments.

Affected Products

Dell PowerFlex Manager (versions listed in Dell advisory DSA-2026-066)
Dell PowerFlex software components bundled with PowerFlex Manager
Refer to the Dell Security Update DSA-2026-066 for full version coverage

Discovery Timeline

2026-06-17 - CVE-2026-35065 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35065

Vulnerability Analysis

The vulnerability stems from missing authentication on a critical function exposed by Dell PowerFlex Manager. PowerFlex Manager orchestrates storage, compute, and network resources in PowerFlex software-defined infrastructure. When a critical function does not enforce authentication, any caller able to reach the service network can invoke privileged operations.

Dell describes the resulting impact as code execution, denial of service, information disclosure, information tampering, remote execution, script injection, and unauthorized access. This combination indicates that the exposed function influences both control-plane logic and data handling within the management interface.

The attack does not require user interaction or prior privileges. The attacker must reach the management service over an adjacent network segment, such as a shared VLAN, management subnet, or directly attached infrastructure network.

Root Cause

The root cause is classified under [CWE-306] Missing Authentication for Critical Function. A function performing security-relevant operations is reachable without verifying the requester's identity. Authentication checks are either absent or bypassable on the affected endpoint.

Attack Vector

Exploitation requires adjacent network access to the PowerFlex Manager service. An attacker positioned on the management network sends a crafted request to the exposed function and receives a response or triggers behavior that would normally require an administrative session. The attacker can then chain the resulting capabilities to execute code, inject scripts, exfiltrate configuration, or disrupt service.

No verified public proof-of-concept code is available for CVE-2026-35065. Refer to the Dell advisory for technical specifics.

Detection Methods for CVE-2026-35065

Indicators of Compromise

Unexpected administrative actions in PowerFlex Manager audit logs originating from hosts that never authenticated
Requests to PowerFlex Manager API endpoints lacking corresponding session establishment events
New or modified storage policies, user accounts, or scripts on PowerFlex Manager that do not map to a change ticket

Detection Strategies

Monitor PowerFlex Manager web and API logs for requests to privileged endpoints that lack an authenticated session identifier
Alert on anomalous source IP addresses contacting the PowerFlex Manager management interface from adjacent subnets
Correlate configuration changes in PowerFlex Manager with authenticated administrator activity and flag mismatches

Monitoring Recommendations

Forward PowerFlex Manager logs to a centralized SIEM and retain them for incident review
Track outbound connections from PowerFlex Manager hosts for signs of post-exploitation activity such as reverse shells or data staging
Baseline normal management traffic patterns and alert on deviations in request volume or endpoint coverage

How to Mitigate CVE-2026-35065

Immediate Actions Required

Apply the fixed PowerFlex software release identified in Dell Security Update DSA-2026-066
Restrict network reachability of PowerFlex Manager to a dedicated, segmented management network
Audit PowerFlex Manager for unauthorized accounts, scripts, and configuration changes prior to patching

Patch Information

Dell has released patched versions of PowerFlex software addressing CVE-2026-35065 as part of advisory DSA-2026-066. Administrators should consult the advisory for the exact fixed versions corresponding to their deployed PowerFlex Manager build and follow Dell's documented upgrade procedure.

Workarounds

Place PowerFlex Manager behind a firewall or ACL that permits only authorized administrative hosts
Disable or block adjacent network access paths that are not required for operations
Enforce jump-host access with multi-factor authentication for any administrative session to PowerFlex Manager

bash

# Example: restrict PowerFlex Manager management access with iptables
# Replace MGMT_CIDR with your authorized admin subnet and MGR_IP with the PowerFlex Manager address
iptables -A INPUT -p tcp -s MGMT_CIDR -d MGR_IP --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d MGR_IP --dport 443 -j DROP