CVE-2026-58566 Overview
CVE-2026-58566 is an incorrect authorization vulnerability [CWE-863] affecting Dell PowerStore. A low-privileged attacker with network access can exploit the flaw to elevate privileges on the affected storage system. Dell disclosed the issue in security advisory DSA-2026-330, which addresses multiple vulnerabilities in Dell PowerStore T.
The vulnerability requires only low-level authentication and no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the storage platform.
Critical Impact
An authenticated attacker with minimal privileges can escalate to higher privileges on Dell PowerStore, gaining unauthorized control over storage operations and data.
Affected Products
- Dell PowerStore T (refer to DSA-2026-330 for exact version ranges)
Discovery Timeline
- 2026-09-01 - CVE-2026-58566 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-58566
Vulnerability Analysis
CVE-2026-58566 is classified as Incorrect Authorization [CWE-863]. Dell PowerStore fails to properly enforce authorization checks on one or more privileged operations. An attacker authenticated with a low-privilege account can invoke functionality that should be restricted to administrators.
Because the check is present but performed incorrectly, the system grants access when it should deny it. This differs from missing authorization; the enforcement logic exists but returns the wrong decision under attacker-controlled conditions.
The result is elevation of privileges within the PowerStore management plane. An attacker who gains higher privileges can read sensitive configuration, modify storage objects, and disrupt availability of provisioned volumes.
Root Cause
The root cause is an authorization decision that does not correctly validate the caller's role or entitlements against the requested operation. Per Dell's advisory, the flaw is present in Dell PowerStore and is remediated by the vendor patch referenced in DSA-2026-330. Specific vulnerable functions and code paths have not been publicly disclosed.
Attack Vector
Exploitation occurs over the network against the PowerStore management interface. The attacker must hold valid credentials for a low-privileged account. No social engineering or user interaction is required. Once authenticated, the attacker issues requests to privileged endpoints, and the incorrect authorization check permits the operation to succeed.
Dell has not reported exploitation in the wild, and CVE-2026-58566 is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.232%.
No public proof-of-concept code is available. See the Dell Security Update DSA-2026-330 for vendor technical details.
Detection Methods for CVE-2026-58566
Indicators of Compromise
- Unexpected administrative actions performed by accounts that normally hold read-only or operator roles.
- Successful API calls to privileged PowerStore management endpoints from low-privileged user sessions.
- Creation, modification, or deletion of storage objects outside change-management windows.
- New local accounts, role assignments, or key exports on PowerStore appliances.
Detection Strategies
- Correlate PowerStore audit logs against expected role-based activity, flagging role-privilege mismatches.
- Baseline normal management-plane API usage per account and alert on deviations, particularly on privilege-sensitive operations.
- Ingest PowerStore syslog and audit events into a SIEM for cross-referencing with identity events.
Monitoring Recommendations
- Forward PowerStore management and audit logs to a centralized logging platform with tamper-evident retention.
- Monitor authentication events for low-privileged accounts making privileged calls within short time windows.
- Alert on configuration exports, credential resets, or replication changes initiated by non-administrative users.
How to Mitigate CVE-2026-58566
Immediate Actions Required
- Apply the Dell PowerStore updates listed in DSA-2026-330 as soon as change windows allow.
- Inventory all PowerStore appliances and confirm firmware or PowerStoreOS versions against the fixed releases.
- Audit all PowerStore user accounts and remove unused or over-privileged identities.
- Rotate credentials for low-privileged PowerStore accounts, especially service and API accounts.
Patch Information
Dell has released remediated versions of PowerStore in advisory DSA-2026-330. Administrators should consult the advisory for the specific fixed versions applicable to their deployment and follow Dell's documented upgrade procedure.
Workarounds
- Restrict network access to the PowerStore management interface to a dedicated management VLAN or jump-host subnet.
- Enforce multi-factor authentication and strong password policies for all PowerStore administrative and non-administrative accounts.
- Reduce the number of accounts with any level of access to PowerStore until patches are applied.
- Increase log retention and review frequency for PowerStore audit events during the exposure window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
