CVE-2026-35162: Dell PowerFlex Manager DoS Vulnerability

CVE-2026-35162 Overview

CVE-2026-35162 is an Improper Access Control vulnerability [CWE-284] affecting Dell PowerFlex Manager. The flaw allows an authenticated, low-privileged attacker with network access to trigger conditions that result in denial of service against the management interface. Dell disclosed the issue in security advisory DSA-2026-066, which addresses multiple vulnerabilities in PowerFlex software.

The vulnerability does not expose data confidentiality or integrity. Availability is the sole impacted security property, and successful exploitation can disrupt storage management operations that depend on PowerFlex Manager.

Critical Impact
A low-privileged remote attacker can exploit improper access control in Dell PowerFlex Manager to cause denial of service, disrupting storage management availability.

Affected Products

Dell PowerFlex Manager (versions listed in Dell Security Update DSA-2026-066)
Dell PowerFlex software components covered by DSA-2026-066
Refer to the vendor advisory for the complete list of affected build numbers

Discovery Timeline

2026-06-17 - CVE-2026-35162 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35162

Vulnerability Analysis

Dell PowerFlex Manager is the unified management plane for PowerFlex software-defined storage deployments. CVE-2026-35162 stems from improper access control [CWE-284] in this management interface. Authorization checks do not adequately restrict actions that a low-privileged authenticated user can perform.

An attacker holding a low-privilege account can reach functionality that should be restricted to higher-privileged roles. Invoking that functionality triggers conditions affecting availability of the management service. The attack is remotely exploitable over the network and requires no user interaction.

Confidentiality and integrity remain unaffected based on the vendor scoring. The vulnerability impacts the availability of PowerFlex Manager, which can interrupt orchestration, monitoring, and provisioning workflows for the underlying storage cluster.

Root Cause

The root cause is missing or insufficient authorization enforcement on one or more PowerFlex Manager interfaces. Access decisions rely on the presence of an authenticated session rather than verifying the user's privilege level for the targeted operation. This allows callers with minimal entitlements to reach functionality whose execution path can degrade service availability.

Attack Vector

Exploitation requires network reachability to PowerFlex Manager and valid low-privilege credentials. The attacker authenticates and then issues requests to endpoints that should be gated by stronger authorization. Because no user interaction is required and attack complexity is low, automation of the attack is straightforward in environments where credential hygiene is weak.

The vulnerability is described in prose only because no public proof-of-concept code is available. Refer to Dell Security Update DSA-2026-066 for vendor-supplied technical context.

Detection Methods for CVE-2026-35162

Indicators of Compromise

Unexpected unavailability or restart of the PowerFlex Manager service following authenticated API or UI activity
Authenticated requests from low-privileged accounts to administrative endpoints inconsistent with the user's assigned role
Spikes in error responses or session terminations in PowerFlex Manager logs from a single account

Detection Strategies

Audit PowerFlex Manager access logs for low-privileged accounts invoking management or configuration endpoints
Correlate authentication events with subsequent service degradation or restart events on the management host
Baseline normal API call patterns per role and alert on deviations involving privileged operations

Monitoring Recommendations

Forward PowerFlex Manager and host operating system logs to a centralized SIEM for retention and correlation
Monitor service health metrics for the PowerFlex Manager process and trigger alerts on unplanned restarts
Track failed and successful authorization decisions to detect probing of restricted endpoints

How to Mitigate CVE-2026-35162

Immediate Actions Required

Apply the security update referenced in Dell Security Update DSA-2026-066 on every PowerFlex Manager instance
Inventory all PowerFlex Manager accounts and remove or disable unused low-privileged accounts
Restrict network access to the PowerFlex Manager interface to trusted management networks only
Rotate credentials for any account suspected of unauthorized use

Patch Information

Dell has published fixed versions in advisory DSA-2026-066. Administrators should consult the advisory for the exact remediated build numbers and follow Dell's upgrade procedure for PowerFlex Manager. No vendor-approved workaround replaces installing the patched release.

Workarounds

Limit PowerFlex Manager exposure using network segmentation, firewalls, and VPN-only access for administrators
Enforce least privilege by reviewing role assignments and removing unnecessary entitlements
Require multi-factor authentication for all PowerFlex Manager accounts where supported
Increase monitoring on the management plane until patches are deployed

bash

# Example: restrict access to PowerFlex Manager to a trusted admin subnet
# Replace 10.10.50.0/24 with your management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP