CVE-2026-79684 Overview
CVE-2026-79684 is a Protection Mechanism Failure vulnerability in Dell PowerStore storage systems. An authenticated user with limited privileges can bypass access restrictions and escalate privileges on the affected system. Dell tracks this issue in security advisory DSA-2026-330 alongside additional PowerStore T vulnerabilities.
The vulnerability is classified under [CWE-693] Protection Mechanism Failure. It requires network access and low privileges, with no user interaction, and impacts confidentiality, integrity, and availability. Successful exploitation grants an attacker elevated control over the storage array, exposing hosted data and management functions.
Critical Impact
An authenticated low-privilege user can bypass access controls on Dell PowerStore and gain escalated privileges, compromising stored data and array management.
Affected Products
- Dell PowerStore T
- See Dell Security Update DSA-2026-330 for the authoritative list of affected versions
Discovery Timeline
- 2026-09-01 - CVE-2026-79684 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Record last modified in NVD
- 2026-09-03 - Exploit Prediction Scoring System (EPSS) probability recorded at 0.349%
Technical Details for CVE-2026-79684
Vulnerability Analysis
The flaw resides in a protection mechanism within Dell PowerStore that fails to enforce role or privilege boundaries on an authenticated session. An operator or read-only user session can invoke functionality reserved for administrators. The result is a full privilege escalation to a higher-privileged context on the array.
Because the attack originates from an authenticated session, an attacker first needs valid credentials or an active session token. Once inside, the missing enforcement allows the attacker to access administrative operations, storage configuration, and potentially data hosted on the array. Compromise of a storage array can cascade into disruption of virtualized workloads, backup targets, and dependent applications.
Dell released DSA-2026-330 to address this vulnerability and other issues in PowerStore T. Administrators should treat the advisory as the source of truth for fixed versions.
Root Cause
The root cause is a Protection Mechanism Failure [CWE-693]. A security control that is intended to gate privileged operations does not correctly evaluate the requester's authorization. Requests that should be denied are instead processed with elevated rights. The specific control point is not disclosed in public references and is described in the vendor advisory.
Attack Vector
Exploitation occurs over the network against the PowerStore management interface. The attacker authenticates with a limited-privilege account, then issues requests that invoke privileged functionality the account should not access. No user interaction is required. Because low-privilege accounts often exist in operations, monitoring, or reporting workflows, the practical attack surface is broader than an administrator-only bug.
No public proof-of-concept exploit is available at the time of publication. The vulnerability is not listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Detection Methods for CVE-2026-79684
Indicators of Compromise
- Administrative configuration changes on PowerStore performed by accounts that normally hold only monitoring or operator roles
- Unexpected creation, modification, or deletion of storage objects such as volumes, hosts, snapshots, or replication sessions
- Authentication events from low-privilege accounts followed by API calls to administrative endpoints
- New local accounts, role assignments, or SSH keys added to the PowerStore management plane
Detection Strategies
- Baseline the API and UI actions expected from each PowerStore role, then alert on any deviation performed by non-administrative accounts
- Correlate PowerStore audit logs with identity-provider logs to detect privilege escalation patterns tied to a single session
- Forward PowerStore audit and syslog data to a centralized analytics platform for behavioral analysis and long-term retention
Monitoring Recommendations
- Enable and export PowerStore audit logging to the security information and event management (SIEM) platform
- Monitor management-plane authentication for anomalous source IPs, unusual times, and repeated privilege-sensitive API calls
- Review role membership on a scheduled cadence and alert on out-of-band changes to administrative roles
How to Mitigate CVE-2026-79684
Immediate Actions Required
- Apply the Dell PowerStore update referenced in Dell Security Update DSA-2026-330
- Inventory all PowerStore appliances and confirm firmware versions against the advisory's fixed release list
- Rotate credentials for low-privilege PowerStore accounts and audit their role assignments
- Restrict management-plane network access to a dedicated administrative network segment
Patch Information
Dell has published fixed versions in advisory DSA-2026-330. Consult the Dell Security Update DSA-2026-330 for the exact fixed PowerStore T releases and upgrade guidance. Apply the update during a maintenance window and validate array health afterward.
Workarounds
- Limit PowerStore management interface exposure to trusted administrative subnets using network access control lists
- Reduce the number of accounts holding any PowerStore role and remove unused low-privilege accounts
- Enforce multi-factor authentication (MFA) on the identity provider fronting PowerStore where supported
# Configuration example: restrict PowerStore management access at the network edge
# Replace interface and subnet values with those specific to your environment
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
