The vulnerability is an authorization bypass flaw in Dell Unisphere for PowerMax vApp that allows an attacker to gain privileged access to the Unisphere for VMAX application. By exploiting this weakness, an attacker could elevate privileges and perform administrative functions normally restricted to authorized users, potentially compromising the confidentiality, integrity, and availability of the VMAX storage environment. The weakness maps to CWE‑285, indicating that improper authorization checks exist within the application code.

This flaw affects Dell Unisphere 360, Dell Unisphere for PowerMax, and Dell Unisphere for PowerMax Virtual Appliance. Any deployment running Unisphere for PowerMax vApp before version 10.0.0.2 is vulnerable. The affected systems are typically a virtual appliance that hosts the Unisphere UI and backend processes, used for managing VMAX storage arrays.

The CVSS score of 6.5 reflects a medium‑to‑high severity, and there is no EPSS data available. The flaw is not listed in the CISA KEV catalog, which suggests no confirmed widespread exploitation yet. Based on the description, the attack vector is likely remote, as the Unisphere UI is accessed over a network. Exploitation would require the attacker to be able to reach the vApp, bypass authentication or authorization checks, and then perform administrative operations. Consequently, the risk is significant for organizations that expose the vApp to untrusted networks or do not enforce strict role‑based access controls.