CVE-2026-79687: Dell PowerStore SDNAS Auth Bypass Flaw

CVE-2026-79687 Overview

CVE-2026-79687 is a missing authentication vulnerability in Dell PowerStore SDNAS (Software-Defined Network Attached Storage). The flaw allows an unauthenticated attacker with remote network access to reach a critical function without providing credentials. Successful exploitation grants filesystem access on the affected storage system.

The issue is classified under [CWE-306] Missing Authentication for Critical Function. Dell published details in advisory DSA-2026-330 covering multiple PowerStore T vulnerabilities.

Critical Impact
Unauthenticated remote attackers can obtain filesystem access on Dell PowerStore SDNAS, exposing stored data confidentiality, integrity, and availability.

Affected Products

Dell PowerStore SDNAS (Software-Defined NAS)
Dell PowerStore T series (per DSA-2026-330)
Refer to Dell advisory for specific fixed versions

Discovery Timeline

2026-09-01 - CVE-2026-79687 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-79687

Vulnerability Analysis

Dell PowerStore SDNAS exposes a critical function over the network without enforcing authentication. The function provides access to filesystem operations that should require authenticated, privileged access. Because the authentication check is absent, any remote client that can reach the service endpoint can invoke the function.

The attack complexity is high, indicating that exploitation requires specific conditions such as timing, configuration state, or reachability of the SDNAS management or data path. When conditions are met, the attacker interacts directly with filesystem resources managed by the appliance.

The scope is changed, meaning a successful attack against the SDNAS component can affect resources beyond the vulnerable component itself, including data owned by tenants that rely on the storage array.

Root Cause

The root cause is a missing authentication control on a critical function within SDNAS. The affected code path does not validate an authenticated session or credential before performing filesystem-level operations. This is a design defect consistent with [CWE-306], where a security-sensitive action is exposed without the required authentication gate.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to the SDNAS service endpoint reachable on the storage management or data network. No user interaction and no prior privileges are required. Successful requests return or manipulate filesystem contents hosted by the PowerStore appliance.

Dell has not publicly released proof-of-concept code, and no exploit is currently available in public repositories. Refer to the Dell Security Advisory DSA-2026-330 for vendor-specific technical details.

Detection Methods for CVE-2026-79687

Indicators of Compromise

Unauthenticated requests to SDNAS service endpoints from unexpected source addresses
Filesystem access events on PowerStore SDNAS without a corresponding authenticated session identifier
Unexpected file reads, writes, or enumeration on NAS shares outside normal client workflows
New or anomalous NFS/SMB session establishment from hosts that are not authorized storage clients

Detection Strategies

Baseline normal client IP ranges and protocols against PowerStore SDNAS and alert on deviations
Correlate NAS access logs with identity provider events to flag actions lacking a valid principal
Enable Dell PowerStore audit logging and forward events to a centralized SIEM for analysis

Monitoring Recommendations

Ingest PowerStore audit and syslog data into a centralized log platform for retention and correlation
Monitor management interface traffic for requests to SDNAS APIs from non-administrative subnets
Alert on privileged filesystem operations that occur outside change-window schedules

How to Mitigate CVE-2026-79687

Immediate Actions Required

Apply the fixed PowerStore version identified in Dell advisory DSA-2026-330 as soon as feasible
Restrict network access to PowerStore management and SDNAS interfaces to trusted administrative subnets
Audit existing SDNAS shares and access logs for signs of unauthorized filesystem interaction
Rotate credentials and review NAS export configurations after patching

Patch Information

Dell released remediation guidance in Dell Security Advisory DSA-2026-330. Administrators should consult the advisory for fixed PowerStore versions and upgrade procedures specific to their deployment.

Workarounds

Place PowerStore management and SDNAS interfaces behind network segmentation with strict ACLs
Limit SDNAS reachability to known storage clients using firewall rules and VLAN isolation
Disable or restrict any non-essential SDNAS services until patching is complete
Increase logging verbosity on PowerStore appliances to capture forensic evidence during the exposure window

bash

# Example: restrict access to PowerStore management interface with iptables
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP