CVE-2026-67262: Dell PowerStore Auth Bypass Vulnerability

CVE-2026-67262 Overview

CVE-2026-67262 is a Missing Authorization vulnerability [CWE-862] affecting Dell PowerStore storage arrays. The flaw allows an attacker with access to a mapped host to read from or write to Logical Unit Numbers (LUNs) that the host is not authorized to access. The vulnerability bypasses per-initiator LUN access controls, resulting in a protection mechanism bypass across tenant or workload boundaries on the same array.

Dell disclosed the issue in security advisory DSA-2026-330. The vulnerability carries a CVSS 3.1 base score of 8.1 with impact to confidentiality, integrity, and availability.

Critical Impact
An authenticated host on a Dell PowerStore array can access LUNs belonging to other hosts, exposing storage data across isolation boundaries.

Affected Products

Dell PowerStore T storage arrays
Deployments relying on per-initiator LUN masking for tenant separation
Systems referenced in Dell advisory DSA-2026-330

Discovery Timeline

2026-08-18 - CVE-2026-67262 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-67262

Vulnerability Analysis

Dell PowerStore enforces LUN access using per-initiator masking. Each host initiator should only see LUNs that administrators have explicitly mapped to it. The vulnerability breaks this control, allowing a mapped host to reach LUNs that were never assigned to its initiator.

The flaw is classified as Missing Authorization [CWE-862]. The storage controller accepts SCSI commands targeting LUNs without verifying that the requesting initiator is authorized for the specified LUN identifier. An attacker who already has legitimate access to any mapped LUN can pivot to unauthorized LUNs on the same array.

Because storage volumes often carry databases, virtual machine disks, and backup images, the impact extends to full read and write access to data belonging to other tenants or workloads. The EPSS score is 0.234% with a percentile of 14.55, reflecting low observed exploitation activity to date.

Root Cause

The root cause is an authorization check missing from the LUN access enforcement path. The array validates host connectivity and session state but does not verify that the initiator has been granted access to the specific LUN referenced by the SCSI request. Per-initiator masking is treated as advisory rather than enforced.

Attack Vector

The attack vector is network-based over the storage fabric. An attacker who compromises or controls a host that is already mapped to the array can issue SCSI commands referencing LUN identifiers outside its assigned set. High attack complexity reflects the need for existing host access and knowledge of target LUN identifiers, but no additional privileges or user interaction are required.

No public proof-of-concept exploit code is available. Technical details are described in prose only; see the Dell Security Update DSA-2026-330 for vendor-supplied information.

Detection Methods for CVE-2026-67262

Indicators of Compromise

Host operating system logs showing block devices or LUN identifiers that were never provisioned to that host.
SCSI inquiry or REPORT LUNS responses returning volumes outside the documented host mapping.
Filesystem signatures, partition tables, or LVM metadata appearing on disks that should be unformatted from the host's perspective.
Unexpected I/O load on PowerStore volumes originating from initiators not listed in the mapping configuration.

Detection Strategies

Compare live LUN visibility on each host against the authoritative PowerStore host-to-LUN mapping export and alert on any divergence.
Monitor PowerStore audit logs for SCSI access patterns where an initiator addresses LUN identifiers outside its assigned range.
Baseline per-host storage I/O and flag hosts that begin issuing reads or writes to previously untouched volumes.

Monitoring Recommendations

Forward PowerStore array audit and I/O telemetry to a centralized SIEM for correlation with host-side block device events.
Enable alerting on new SCSI device discoveries on production hosts outside change windows.
Review initiator group and host group definitions on a recurring schedule and confirm they match intended isolation boundaries.

How to Mitigate CVE-2026-67262

Immediate Actions Required

Apply the PowerStoreOS update referenced in Dell advisory DSA-2026-330 as soon as it is available for your model.
Inventory all hosts mapped to each PowerStore array and verify that no host is currently accessing LUNs outside its assigned set.
Restrict administrative and fabric access to the array to trusted operators until patching is complete.

Patch Information

Dell has published fixed PowerStoreOS versions through security advisory DSA-2026-330. Refer to the advisory for the exact fixed builds that correspond to your PowerStore T model and current firmware release. Apply the patch following Dell's non-disruptive upgrade procedure for PowerStore.

Workarounds

Segment critical workloads onto dedicated PowerStore arrays until the patch is applied so a compromised host cannot reach unrelated tenant data.
Tighten fabric zoning so only required initiator-target pairs can communicate, reducing the set of LUNs reachable from any single host.
Increase logging verbosity on the array and on mapped hosts to accelerate identification of unauthorized LUN access during the exposure window.

bash

# Verify observed LUNs against expected mapping on a Linux host
lsscsi --scsi_id
sg_luns /dev/sg0
# Compare output to the PowerStore host mapping export before patching