CVE-2026-58567: Dell PowerStore RCE Vulnerability

CVE-2026-58567 Overview

CVE-2026-58567 is an operating system command injection vulnerability [CWE-78] in Dell PowerStore. An authenticated user with limited privileges can inject arbitrary operating system commands that execute with root privileges. The flaw crosses a privilege boundary, allowing a low-privilege local account to fully compromise the storage appliance. Dell published guidance in security advisory DSA-2026-330.

Critical Impact
A low-privileged authenticated user can execute arbitrary commands as root, resulting in full compromise of PowerStore confidentiality, integrity, and availability.

Affected Products

Dell PowerStore T
Refer to Dell advisory DSA-2026-330 for the complete list of impacted versions
See the Dell Security Update Advisory for fixed release details

Discovery Timeline

2026-09-01 - CVE-2026-58567 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-58567

Vulnerability Analysis

The vulnerability is an OS command injection issue classified under [CWE-78]. Dell PowerStore accepts input from an authenticated user with limited privileges and passes that input into an operating system command context without sufficient sanitization. An attacker who supplies specially crafted metacharacters causes the storage platform to execute attacker-controlled commands. Because the affected code path runs with root privileges, exploitation results in a scope change from a bounded user session to full administrative control of the appliance.

Successful exploitation grants the attacker the ability to modify configuration, read all data managed by PowerStore, disrupt storage services, and pivot into adjacent management networks. The EPSS score is 0.513% at the 41.7 percentile, indicating limited near-term exploitation activity, though the impact profile warrants prompt remediation.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. Dell PowerStore invokes system-level commands using input derived from an authenticated management interface without validating or escaping shell metacharacters. This allows injected payloads to execute in the underlying shell with the privileges of the calling process, which runs as root.

Attack Vector

Exploitation requires local access to the PowerStore management surface with valid, low-privilege credentials. No user interaction is required. The attack complexity is low and the scope changes from the authenticated user context to root-level command execution on the underlying system. Refer to the Dell Security Update Advisory for exploitation prerequisites and vendor-supplied technical detail.

No public proof-of-concept code has been published for CVE-2026-58567 at this time. Detailed exploitation code is therefore not reproduced here.

Detection Methods for CVE-2026-58567

Indicators of Compromise

Unexpected shell processes (sh, bash) spawned as children of PowerStore management daemons.
Commands executing as root that originate from user-driven API or CLI requests submitted by non-administrative accounts.
Anomalous outbound network connections initiated from the PowerStore appliance to attacker-controlled hosts.
New or modified files in system directories, cron entries, or SSH authorized_keys created after a low-privilege user session.

Detection Strategies

Enable verbose audit logging on the PowerStore management interface and forward logs to a centralized SIEM for correlation.
Alert on management API requests containing shell metacharacters such as ;, |, &, backticks, or $(.
Baseline the expected process tree for PowerStore services and alert on deviations, particularly root-level command execution triggered by non-admin users.

Monitoring Recommendations

Review authentication logs for low-privilege account use immediately preceding privileged command activity.
Monitor administrative CLI and REST API traffic to PowerStore for unusual parameter payloads or encoded characters.
Track configuration changes and account creation events on the appliance and correlate with the initiating user identity.

How to Mitigate CVE-2026-58567

Immediate Actions Required

Apply the fixed PowerStore release identified in Dell advisory DSA-2026-330 as soon as change control allows.
Rotate credentials for all PowerStore local and directory-integrated accounts, especially any low-privilege service accounts.
Restrict management-plane network access to a dedicated administrative VLAN reachable only from trusted jump hosts.
Audit existing PowerStore user accounts and remove unused or over-provisioned identities.

Patch Information

Dell has published remediation guidance in the Dell Security Update Advisory DSA-2026-330. Administrators should follow Dell's documented upgrade path for PowerStore T and validate the fixed version in a non-production environment before deploying broadly.

Workarounds

Limit management interface exposure to a restricted administrative network segment.
Enforce multi-factor authentication on any identity provider integrated with PowerStore management.
Reduce the number of accounts with any PowerStore login capability until patching is complete.

bash

# Example: restrict management-plane access with host-based ACLs on jump hosts
# Only allow SSH from the storage admin bastion to the PowerStore management IP
iptables -A OUTPUT -p tcp -d <powerstore_mgmt_ip> --dport 22 -m owner --uid-owner storageadmin -j ACCEPT
iptables -A OUTPUT -p tcp -d <powerstore_mgmt_ip> --dport 22 -j DROP