CVE-2026-35069: Dell PowerFlex Manager SQLi Vulnerability

CVE-2026-35069 Overview

CVE-2026-35069 is a SQL Injection vulnerability [CWE-89] affecting Dell PowerFlex Manager. The flaw stems from improper neutralization of special elements used in a SQL command. A low-privileged attacker with adjacent network access can exploit the vulnerability to achieve script injection within the application context.

The vulnerability requires authentication and adjacent network positioning, limiting its exposure to attackers who already hold a foothold on the same logical network segment as the management interface. Dell published advisory DSA-2026-066 to address this issue alongside other PowerFlex software vulnerabilities.

Critical Impact
An authenticated adjacent-network attacker can inject SQL statements into PowerFlex Manager, leading to script injection and exposure of sensitive data managed by the platform.

Affected Products

Dell PowerFlex Manager (multiple versions, see vendor advisory DSA-2026-066)
Dell PowerFlex software components referenced in DSA-2026-066
Deployments exposing the PowerFlex Manager interface to adjacent network segments

Discovery Timeline

2026-06-17 - CVE-2026-35069 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35069

Vulnerability Analysis

The vulnerability resides in input handling within Dell PowerFlex Manager, where user-supplied data flows into a SQL query without adequate sanitization or parameterization. An authenticated user can inject SQL syntax through an affected request parameter. The database engine then interprets the malicious payload as part of the query structure.

According to Dell's advisory, successful exploitation leads to script injection. This indicates that injected SQL content can be stored and later rendered to other users or administrative consoles, broadening the impact beyond the initial database query. The attack is constrained to adjacent network positioning, meaning the attacker must reach the management plane directly rather than through arbitrary internet routes.

Exploitation does not impact integrity or availability of the underlying data store directly, but it does expose confidential information accessible to the application's database account.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The affected code path concatenates attacker-controlled input into SQL statements rather than using prepared statements or strict allow-list validation. This permits the database driver to parse attacker syntax as query logic.

Attack Vector

The attack vector is Adjacent Network (AV:A) and requires low privileges (PR:L) with no user interaction (UI:N). The attacker authenticates to PowerFlex Manager with a low-privilege account, then submits crafted input to a vulnerable endpoint. The injected SQL payload executes within the application's database context, returning data or storing content that triggers script injection when rendered.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are detailed in the Dell Security Update DSA-2026-066.

Detection Methods for CVE-2026-35069

Indicators of Compromise

Application or database logs containing SQL meta-characters such as ', --, ;, UNION SELECT, or OR 1=1 in PowerFlex Manager request parameters
Unexpected outbound queries or large result sets originating from the PowerFlex Manager database account
Stored values within PowerFlex Manager tables containing HTML or JavaScript fragments such as <script> tags

Detection Strategies

Inspect PowerFlex Manager web access logs for parameters containing SQL syntax tokens and encode-variant payloads such as %27 or %20OR%20
Correlate authenticated session activity from low-privilege accounts with anomalous request volumes against management endpoints
Compare database query patterns against a known baseline to flag queries that deviate in structure or row count

Monitoring Recommendations

Forward PowerFlex Manager web server and database audit logs to a centralized SIEM for retention and correlation
Alert on authentication events from low-privilege PowerFlex accounts followed by access to administrative URLs
Monitor adjacent network segments hosting PowerFlex management interfaces for unauthorized hosts and lateral movement

How to Mitigate CVE-2026-35069

Immediate Actions Required

Apply the fixed versions identified in Dell advisory DSA-2026-066 to all PowerFlex Manager instances
Restrict network access to PowerFlex Manager interfaces so only authorized administrative hosts can reach them
Audit local PowerFlex Manager accounts and remove or disable unused low-privilege users
Rotate credentials for any account that may have been used to test or exploit the vulnerability

Patch Information

Dell has released remediated versions of PowerFlex Manager as documented in Dell Security Update DSA-2026-066. Administrators should consult the advisory for the exact fixed version mapping and follow Dell's documented upgrade procedure for their deployment topology.

Workarounds

Place PowerFlex Manager behind a management VLAN or jump host that enforces strict access control lists until patches are applied
Enforce least-privilege role assignments so that operational accounts cannot reach the affected endpoints
Deploy a web application firewall rule set in front of PowerFlex Manager to block common SQL injection patterns as a compensating control

bash

# Example: restrict PowerFlex Manager access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP