CVE-2026-58575: Dell PowerStore Auth Bypass Vulnerability

CVE-2026-58575 Overview

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability [CWE-290] that allows an authenticated attacker to escalate privileges to Administrator. The flaw resides in the PowerStore T platform and is addressed in Dell Security Advisory DSA-2026-330.

An attacker with valid low-privilege credentials can spoof authentication context to gain full administrative control of the storage system. Successful exploitation compromises confidentiality, integrity, and availability of managed data and configuration.

Critical Impact
An authenticated low-privilege attacker can escalate to Administrator over the network, gaining full control of Dell PowerStore storage arrays and the data they manage.

Affected Products

Dell PowerStore T
See Dell Security Update DSA-2026-330 for affected versions

Discovery Timeline

2026-09-01 - CVE CVE-2026-58575 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-58575

Vulnerability Analysis

The vulnerability is classified as Authentication Bypass by Spoofing [CWE-290] in the Dell PowerStore management stack. An authenticated user with limited privileges can craft requests that spoof identity or role attributes trusted by the authentication layer.

The PowerStore system fails to fully verify the origin or integrity of authentication claims. As a result, the attacker's session is granted the effective permissions of an Administrator account. The impact spans confidentiality, integrity, and availability of the storage platform and hosted volumes.

Because the attack vector is network-based and requires only low privileges without user interaction, any account on the management network becomes a viable pivot point. EPSS data as of 2026-09-03 reports a probability of 0.299%.

Root Cause

CWE-290 vulnerabilities arise when an authentication mechanism trusts spoofable inputs such as headers, tokens, or identity assertions without cryptographic verification. In Dell PowerStore, the flaw allows attacker-controlled data to influence privilege decisions during session validation. Dell has not published detailed technical internals in the public advisory.

Attack Vector

The attacker first obtains low-privilege authenticated access to the PowerStore management interface. This access can come from stolen credentials, a compromised operator account, or an insider. The attacker then sends crafted management requests that manipulate identity or role fields the system fails to validate correctly. The management plane processes these requests with Administrator privileges, granting the attacker full control over storage configuration, replication, and access policies. No verified proof-of-concept code is publicly available. Refer to the Dell Security Update DSA-2026-330 for further technical detail.

Detection Methods for CVE-2026-58575

Indicators of Compromise

Unexpected privilege elevation events for standard user accounts on PowerStore management interfaces.
Administrative actions (user creation, role changes, volume access modifications) originating from low-privilege accounts.
Anomalous API calls to PowerStore management endpoints outside normal operator workflows.

Detection Strategies

Audit PowerStore role assignments and compare against a known-good baseline of administrators.
Alert on any session where the effective role differs from the account's assigned role in the identity store.
Correlate authentication events with subsequent privileged operations to spot spoofed session activity.

Monitoring Recommendations

Forward PowerStore audit logs to a centralized SIEM and retain them for at least 90 days.
Monitor management-plane network segments for lateral movement toward storage controllers.
Track configuration changes (users, roles, replication targets) and require change-ticket correlation.

How to Mitigate CVE-2026-58575

Immediate Actions Required

Apply the patched PowerStore firmware version listed in Dell Security Update DSA-2026-330.
Rotate credentials for all PowerStore administrative and operator accounts after patching.
Review audit logs for privilege escalation activity predating the patch window.

Patch Information

Dell has released fixed firmware for PowerStore T. Consult DSA-2026-330 for the exact fixed version and upgrade path applicable to your deployment. Coordinate maintenance windows with storage and application owners to minimize disruption during controller updates.

Workarounds

Restrict PowerStore management interface access to a dedicated administrative network or jump host.
Enforce multi-factor authentication on all upstream identity providers that federate to PowerStore.
Remove or disable unused low-privilege accounts to reduce the pool of viable attacker footholds.
Apply strict network ACLs so only authorized management stations can reach the PowerStore control plane.

bash

# Configuration example: restrict PowerStore management access with host firewall
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP