CVE-2026-40635 Overview
CVE-2026-40635 affects Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0. The flaw is an insecure temporary file vulnerability [CWE-377] that a low-privileged remote attacker can exploit over the network. Successful exploitation can lead to denial of service and integrity tampering on affected clustered storage systems.
The issue does not expose confidential data directly but allows attackers to disrupt file operations and modify data handled through unsafe temporary file usage. Dell published advisory DSA-2026-360 to address this issue along with additional PowerScale OneFS vulnerabilities.
Critical Impact
A low-privileged remote attacker can trigger denial of service and tamper with data on Dell PowerScale OneFS clusters running affected releases.
Affected Products
- Dell PowerScale OneFS 9.12.0.0
- Dell PowerScale OneFS versions between 9.12.0.0 and 9.13.1.0
- Dell PowerScale OneFS 9.13.1.0
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-40635 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-40635
Vulnerability Analysis
The vulnerability stems from insecure handling of temporary files within Dell PowerScale OneFS. When an application writes to a predictable or insufficiently protected temporary path, an attacker with local session context on the cluster can interact with those files during the window between creation and use.
Because OneFS is a distributed file system serving enterprise workloads, tampering with temporary artifacts can cascade into downstream service failures. The advisory notes both denial of service and information tampering as outcomes, indicating that attacker-controlled content or timing can influence process behavior.
Exploitation requires authenticated access with low privileges. No user interaction is needed, and the attack is executed over the network against exposed OneFS management or data-plane interfaces.
Root Cause
The root cause is classified as CWE-377: Insecure Temporary File. OneFS components create temporary files without sufficient safeguards such as unique random names, restrictive permissions, or atomic creation flags. This allows a co-resident low-privileged actor to predict, read, replace, or delete those files before they are consumed by the trusted process.
Attack Vector
An authenticated remote attacker with low privileges targets a component that writes temporary files during normal operation. The attacker races the trusted process to substitute or corrupt the temporary artifact, or exhausts related resources to trigger a service disruption. Refer to the Dell Security Update DSA-2026-360 for vendor-specific exploitation context.
No public proof-of-concept code is currently available for this issue.
Detection Methods for CVE-2026-40635
Indicators of Compromise
- Unexpected files appearing in OneFS temporary directories with non-standard ownership or timestamps.
- Repeated service restarts or crashes in OneFS daemons that consume temporary files.
- Authenticated sessions from low-privileged accounts performing unusual filesystem operations on temp paths.
Detection Strategies
- Audit filesystem activity for creation, replacement, or symlink operations against known OneFS temporary directories.
- Correlate authentication logs with subsequent filesystem write operations from low-privileged principals.
- Monitor OneFS system logs for parse errors, checksum mismatches, or repeated failures tied to temporary file consumption.
Monitoring Recommendations
- Forward OneFS audit and system logs to a centralized analytics platform for retention and correlation.
- Baseline normal temporary file activity per node and alert on deviations in volume or file naming patterns.
- Track privilege usage for all remote accounts that can interact with OneFS APIs or shells.
How to Mitigate CVE-2026-40635
Immediate Actions Required
- Apply the Dell PowerScale OneFS security update referenced in DSA-2026-360 as soon as maintenance windows allow.
- Inventory clusters running versions 9.12.0.0 through 9.13.1.0 and prioritize internet-exposed or multi-tenant systems.
- Review and reduce the number of low-privileged remote accounts able to reach OneFS management and data interfaces.
Patch Information
Dell has released a fixed version of PowerScale OneFS through advisory DSA-2026-360. Consult the Dell Security Update DSA-2026-360 for supported upgrade paths and version details.
Workarounds
- Restrict network access to OneFS management and API endpoints using firewall rules or network segmentation.
- Enforce strong authentication and least-privilege access for all accounts that can reach the cluster.
- Increase log retention and alerting on OneFS nodes until patches are applied across the environment.
# Configuration example
# Verify running OneFS version before and after patching
isi version
# Restrict management access to trusted subnets (example)
isi network subnets modify groupnet0.subnet0 --sc-service-addrs=<trusted_subnet>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
