CVE-2026-58574: Dell PowerStore Auth Bypass Vulnerability

CVE-2026-58574 Overview

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability [CWE-306] in its restricted management interface. An unauthenticated attacker with network access can read internal system information directly from the appliance filesystem. Exposed data includes sensitive configuration content and credentials that grant full administrative control of the storage array. Dell has published advisory DSA-2026-330 addressing this issue alongside other flaws in PowerStore T.

Critical Impact
Unauthenticated network attackers can retrieve credentials from the PowerStore filesystem and obtain full administrative access to the storage array.

Affected Products

Dell PowerStore T
Dell PowerStore appliance management interface
Refer to Dell advisory DSA-2026-330 for specific affected versions

Discovery Timeline

2026-08-31 - CVE-2026-58574 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-58574

Vulnerability Analysis

The vulnerability is a Missing Authentication for Critical Function flaw affecting the Dell PowerStore management interface. A function that reads from the appliance filesystem is exposed on the management network without any authentication gate. An attacker who reaches the restricted management interface over the network can invoke this function and retrieve internal system files. Because credentials are stored within reachable files, exploitation results in full compromise of the array, including data confidentiality, integrity, and availability.

Root Cause

The root cause is the absence of an authentication check on a critical filesystem-read function exposed by the management interface. Sensitive resources including credential material are accessible without validating the caller's identity. The design assumes network segmentation of the management interface provides sufficient protection, but that assumption fails when an attacker reaches the segment.

Attack Vector

The attack requires network access to the PowerStore restricted management interface. No credentials, no user interaction, and no elevated privileges are needed. An attacker on the management network issues a request to the vulnerable endpoint and receives filesystem contents in response. Recovered administrative credentials then permit authenticated administrative operations against the array, including data exfiltration, tampering, and destruction.

No public proof-of-concept is available at the time of publication. Technical specifics beyond the advisory description are limited. See the Dell Security Update DSA-2026-330 for vendor-published details.

Detection Methods for CVE-2026-58574

Indicators of Compromise

Unexpected HTTP or API requests to PowerStore management endpoints from hosts that do not normally administer storage.
Outbound data transfers from the PowerStore management interface to unrecognized destinations.
New or unexpected administrative sessions on the array following anomalous management-interface traffic.
Log gaps or configuration changes on the appliance that cannot be attributed to authorized change requests.

Detection Strategies

Monitor management-network traffic for unauthenticated requests to PowerStore filesystem-related paths.
Correlate anomalous management-interface access with subsequent administrator logins to detect credential reuse.
Alert on any access to the PowerStore management interface originating outside approved administrative jump hosts.

Monitoring Recommendations

Forward PowerStore audit logs and management-plane access logs to a centralized SIEM for retention and analysis.
Baseline normal administrative activity windows, source IPs, and user agents, then alert on deviations.
Track privileged operations executed against the array and reconcile them against approved change tickets.

How to Mitigate CVE-2026-58574

Immediate Actions Required

Apply the fixed PowerStore firmware version identified in Dell advisory DSA-2026-330 as soon as maintenance windows permit.
Restrict access to the PowerStore management interface to a dedicated, ACL-enforced management VLAN.
Rotate all administrative credentials on affected PowerStore arrays after patching, assuming potential prior exposure.
Audit recent administrative sessions and configuration changes on affected appliances for signs of misuse.

Patch Information

Dell has released a security update for PowerStore T. Consult the Dell Security Update DSA-2026-330 for fixed versions, upgrade procedures, and any additional vulnerabilities addressed in the same release.

Workarounds

Isolate the management interface on a segmented network reachable only from hardened administrative jump hosts.
Enforce firewall rules that deny all inbound traffic to the management interface except from explicitly allow-listed administrator sources.
Require multi-factor authentication and privileged access management for any host permitted to reach the management network.

bash

# Example: restrict PowerStore management interface access with iptables on an upstream gateway
# Replace values with your environment specifics
MGMT_IF="eth1"
POWERSTORE_MGMT="10.10.20.0/24"
ADMIN_JUMP="10.10.99.10"

iptables -A FORWARD -i $MGMT_IF -s $ADMIN_JUMP -d $POWERSTORE_MGMT -j ACCEPT
iptables -A FORWARD -i $MGMT_IF -d $POWERSTORE_MGMT -j DROP