CVE-2026-46460 Overview
Dell PowerScale OneFS contains an incorrect authorization vulnerability [CWE-863] that allows a low-privileged attacker on an adjacent network to modify system logs without proper authorization. The flaw affects OneFS versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0. Successful exploitation impacts the integrity of audit and system log data, which can hinder incident response and forensic investigations. Dell disclosed the issue in security advisory DSA-2026-360.
Critical Impact
An adjacent-network attacker with low privileges can tamper with system logs on affected Dell PowerScale OneFS clusters, undermining audit integrity and forensic reliability.
Affected Products
- Dell PowerScale OneFS 9.5.0.0 through 9.7.1.15
- Dell PowerScale OneFS 9.8.0.0 through 9.13.1.0
- Dell PowerScale OneFS versions prior to 9.15.0.0
Discovery Timeline
- 2026-09-09 - CVE-2026-46460 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-46460
Vulnerability Analysis
CVE-2026-46460 is an incorrect authorization weakness in the Dell PowerScale OneFS distributed storage operating system. The flaw permits a low-privileged account reachable from the adjacent network to perform actions on system logs that should be restricted to higher-privileged administrators. Because the attack vector is adjacent (AV:A), the attacker must have access to a network segment shared with the OneFS cluster, such as the internal back-end or management network. The impact is limited to integrity of log data, with no direct confidentiality or availability effect.
Root Cause
The underlying issue maps to CWE-863 (Incorrect Authorization). OneFS evaluates a caller's privileges but fails to enforce the correct authorization decision before allowing modifications to system log records. As a result, an authenticated user without sufficient rights can perform log-write or log-alteration operations that should be restricted to administrative roles.
Attack Vector
Exploitation requires network adjacency to the target OneFS cluster and valid low-privileged credentials. No user interaction is required. Once authenticated, the attacker issues log-modification requests through the exposed OneFS management or service interfaces. Successful requests allow the attacker to insert, alter, or remove log entries, obscuring subsequent malicious activity or manipulating audit trails referenced by security operations teams.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. See the Dell Security Update DSA-2026-360 for vendor-provided technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-46460
Indicators of Compromise
- Unexpected gaps, truncations, or out-of-sequence entries in OneFS system and audit logs.
- Log entries attributed to low-privileged user accounts performing administrative or log-management actions.
- Authentication events from unusual adjacent-network hosts followed by log-write API calls.
Detection Strategies
- Forward OneFS audit and system logs to an external log repository in near real time so tampering on the cluster does not erase the original record.
- Compare on-cluster log content against the externally forwarded copy to detect discrepancies indicative of tampering.
- Alert on privilege-role mismatches: log-modification actions performed by accounts not assigned an administrative OneFS role.
Monitoring Recommendations
- Monitor the OneFS management and back-end networks for authentication activity from unexpected sources or service accounts.
- Track OneFS version and patch level via configuration management to ensure clusters remain on a fixed release.
- Baseline normal log-generation rates per node and alert on sudden drops or anomalous edits.
How to Mitigate CVE-2026-46460
Immediate Actions Required
- Upgrade Dell PowerScale OneFS to version 9.15.0.0 or later, per Dell advisory DSA-2026-360.
- Inventory all OneFS clusters and identify any running affected versions between 9.5.0.0 and 9.13.1.0.
- Review recent OneFS audit and system logs for signs of unauthorized modification prior to patching.
Patch Information
Dell has published fixed releases in the Dell Security Update DSA-2026-360. Administrators should apply the vendor-supplied OneFS update that resolves CVE-2026-46460 and validate cluster health after upgrade.
Workarounds
- Restrict access to the OneFS management and back-end networks to trusted administrative hosts only.
- Enforce least-privilege role assignments and remove unnecessary low-privileged accounts with cluster access.
- Ensure OneFS logs are forwarded to an external SIEM or syslog collector so a tamper-resistant copy is preserved off-cluster.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
