CVE-2026-58572 Overview
CVE-2026-58572 is a code injection vulnerability [CWE-94] affecting Dell PowerStore. An authenticated user with limited privileges can exploit this flaw to execute arbitrary code with root privileges on the affected system. The vulnerability requires local access and low privileges, but no user interaction. Successful exploitation results in a scope change, granting the attacker full control over confidentiality, integrity, and availability of the storage platform.
Critical Impact
An authenticated low-privileged user can execute arbitrary code as root, resulting in full compromise of the Dell PowerStore appliance and the data it manages.
Affected Products
- Dell PowerStore T
- Dell PowerStore (versions addressed in Dell Security Update DSA-2026-330)
- See the Dell Security Update DSA-2026-330 advisory for the complete list of affected versions.
Discovery Timeline
- 2026-09-01 - CVE-2026-58572 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-58572
Vulnerability Analysis
CVE-2026-58572 is a code injection issue in Dell PowerStore classified under [CWE-94] (Improper Control of Generation of Code). The flaw allows an authenticated actor with limited privileges on the appliance to inject and execute arbitrary code. Because the injected code runs with root privileges, an attacker crosses a privilege boundary and achieves full administrative control of the storage system. The scope change reflected in the CVSS vector indicates the vulnerable component and the impacted component are not the same, meaning the exploit affects resources beyond the initially authorized security context.
Root Cause
The root cause is improper neutralization of user-controlled input that is subsequently interpreted as code by a privileged component of Dell PowerStore. When input reaches an execution or evaluation function without adequate sanitization, an attacker can craft input that alters the intended control flow. The privileged process then executes attacker-supplied instructions as root. Dell has not publicly disclosed the specific vulnerable component. Refer to the Dell Security Update DSA-2026-330 advisory for vendor-provided technical context.
Attack Vector
The attack vector is local. An attacker must first authenticate to the PowerStore appliance with at least low-level privileges, for example through an administrative shell, management API, or service account. Once authenticated, the attacker submits crafted input to the vulnerable component. The component processes that input as executable code within a root-owned process, granting the attacker persistent, privileged control. No user interaction is required to complete exploitation.
No verified proof-of-concept code is publicly available for CVE-2026-58572. See the vendor advisory for technical details.
Detection Methods for CVE-2026-58572
Indicators of Compromise
- Unexpected root-owned processes spawned from PowerStore management or service accounts.
- New or modified binaries, scripts, or cron entries in system directories on the appliance.
- Anomalous outbound network connections originating from the PowerStore controller.
- Authentication events for limited-privilege accounts followed shortly by privileged operations.
Detection Strategies
- Audit PowerStore management-plane logs for command execution patterns that deviate from documented administrative workflows.
- Correlate low-privilege user sessions with subsequent root-level activity on the same appliance.
- Monitor configuration changes, service restarts, and firmware modifications that occur outside change-management windows.
Monitoring Recommendations
- Forward PowerStore audit, authentication, and shell logs to a centralized SIEM for retention and correlation.
- Alert on privilege escalation indicators, including sudden uid=0 activity from non-root service contexts.
- Track access to the PowerStore management network from unexpected hosts or accounts.
How to Mitigate CVE-2026-58572
Immediate Actions Required
- Apply the security update referenced in Dell Security Update DSA-2026-330 to all affected Dell PowerStore systems.
- Inventory PowerStore appliances and confirm current firmware or software versions against Dell's fixed release list.
- Rotate credentials for any low-privilege accounts on PowerStore that may have been exposed.
Patch Information
Dell has released fixed versions for Dell PowerStore. Refer to Dell Security Update DSA-2026-330 for the specific fixed builds, upgrade procedures, and additional vulnerabilities addressed in the same advisory. Prioritize patching internet-adjacent management interfaces and production storage arrays first.
Workarounds
- Restrict management-network access to a limited set of trusted administrator workstations and jump hosts.
- Enforce the principle of least privilege by removing unnecessary local accounts and API tokens on PowerStore.
- Enable multi-factor authentication and logging for all administrative access to the appliance.
- Segment PowerStore management interfaces from general user networks until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
