CVE-2026-35067 Overview
CVE-2026-35067 is an Improper Access Control vulnerability [CWE-284] affecting Dell PowerFlex Manager. The flaw allows a low-privileged attacker with adjacent network access to elevate privileges and gain unauthorized access to protected resources. Dell published security advisory DSA-2026-066 to address this issue along with other vulnerabilities in PowerFlex software.
The vulnerability carries a CVSS 3.1 base score of 5.7 (Medium). Exploitation requires existing low-level privileges and proximity to the adjacent network segment, which constrains opportunistic abuse. However, in flat or poorly segmented storage management networks, the attack surface widens.
Critical Impact
Successful exploitation grants an authenticated adjacent attacker elevated privileges within PowerFlex Manager, exposing confidential configuration and storage management functions.
Affected Products
- Dell PowerFlex Manager (versions listed in Dell advisory DSA-2026-066)
- Dell PowerFlex software components covered by DSA-2026-066
- Deployments exposing PowerFlex Manager to shared management networks
Discovery Timeline
- 2026-06-17 - CVE-2026-35067 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-35067
Vulnerability Analysis
Dell PowerFlex Manager is the unified management interface for PowerFlex software-defined storage clusters. The vulnerability stems from improper enforcement of access control checks on operations that should be restricted to higher-privileged roles. An authenticated user with limited privileges can invoke functions or reach resources that should require administrative authorization.
The flaw is classified under [CWE-284] Improper Access Control. Because the impact metric reflects high confidentiality loss without integrity or availability impact, the primary risk is unauthorized disclosure of management state, credentials, or storage topology rather than data destruction.
Adjacent network access is required, meaning the attacker must reside on the same logical layer-2 segment or VLAN as the PowerFlex management interface. Environments that place storage management on a dedicated network reduce exposure significantly.
Root Cause
The root cause is missing or insufficient authorization checks within PowerFlex Manager functions. Access decisions appear to rely on authentication state without consistently verifying the caller's role for sensitive operations. Dell has not published low-level technical details beyond the advisory.
Attack Vector
An attacker first authenticates to PowerFlex Manager with a low-privileged account. From the adjacent network, the attacker issues requests to endpoints or API paths that lack proper role-based authorization enforcement. The server processes these requests and returns data or state belonging to higher-privileged contexts. No user interaction is required.
No public proof-of-concept or exploit code is currently available for CVE-2026-35067. Refer to the Dell Security Update DSA-2026-066 for vendor-supplied technical context.
Detection Methods for CVE-2026-35067
Indicators of Compromise
- Unexpected API calls from low-privileged PowerFlex Manager accounts to administrative endpoints.
- Authentication events from unusual adjacent hosts on the storage management VLAN.
- Configuration reads or exports performed by accounts that do not normally execute such operations.
Detection Strategies
- Audit PowerFlex Manager access logs for role escalation patterns and anomalous endpoint access by standard user accounts.
- Correlate authentication events with subsequent privileged operations to flag mismatches between role and action.
- Deploy network monitoring on the storage management segment to capture lateral access attempts to PowerFlex Manager ports.
Monitoring Recommendations
- Forward PowerFlex Manager audit logs to a centralized SIEM with retention sufficient for incident review.
- Alert on repeated authorization failures followed by successful sensitive operations from the same source.
- Monitor the management VLAN for new or unauthorized hosts that could serve as a foothold for adjacent attacks.
How to Mitigate CVE-2026-35067
Immediate Actions Required
- Apply the updates listed in Dell advisory DSA-2026-066 to all PowerFlex Manager instances.
- Inventory PowerFlex Manager accounts and remove or restrict low-privileged accounts that no longer require access.
- Restrict management plane connectivity to a dedicated VLAN reachable only by authorized administrative hosts.
Patch Information
Dell has released fixed versions of PowerFlex software as documented in Dell Security Update DSA-2026-066. Administrators should consult the advisory to identify the specific fixed version applicable to their deployment and follow Dell's upgrade procedure for PowerFlex Manager.
Workarounds
- Isolate the PowerFlex management network using strict VLAN segmentation and access control lists until patching completes.
- Enforce least-privilege role assignments and remove unused low-privileged accounts that could be leveraged as a launch point.
- Require multi-factor authentication and jump-host access for PowerFlex Manager administration to limit adjacent exposure.
# Example: restrict management VLAN access with an ACL (illustrative)
# Replace interfaces, ACL name, and IP ranges with site-specific values
ip access-list extended POWERFLEX-MGMT
permit ip 10.10.50.0 0.0.0.255 host 10.20.0.10
deny ip any host 10.20.0.10 log
permit ip any any
!
interface Vlan20
ip access-group POWERFLEX-MGMT in
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
