Description
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Published: 2026-10-14
Score: 6.6 Medium
EPSS: 1.1% Low
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

The vulnerability is an OS Command Injection flaw that allows an attacker with high privileges and remote access to the Dell Unisphere for PowerMax vApp to execute arbitrary operating system commands. This flaw can lead to full control of the underlying host system, compromising confidentiality, integrity, and availability of data managed by the appliance.

Affected Systems

Dell Unisphere for PowerMax vApp, version 9.2.4.x, is the affected product. The vulnerability applies only to the specified Dell virtualization appliance.

Risk and Exploitability

The CVSS score of 6.6 indicates a medium severity threat, and the EPSS score of 1% suggests a low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to possess a high‑privileged account with remote connectivity to the vApp. With this low but real exploitation probability and the potential for remote code execution, the risk is moderate, and prompt remediation is essential.

Generated by OpenCVE AI on October 15, 2026 at 22:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Dell’s support site or security advisories for any available updates or patches for Unisphere for PowerMax vApp; if unreleased, proceed with best‑practice mitigations.
  • Restrict remote administration of the vApp to the minimum set of required privileged accounts and consider disabling any unused remote services.
  • Enable and regularly review audit logging to detect anomalous command execution or unintended activity on the appliance.

Generated by OpenCVE AI on October 15, 2026 at 22:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Leading to Remote Code Execution in Dell Unisphere for PowerMax vApp

Thu, 15 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Leading to Remote Code Execution in Dell Unisphere for PowerMax vApp

Wed, 14 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-15T10:31:15.936Z

Reserved: 2026-09-28T10:05:09.902Z

Link: CVE-2026-101215

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T14:17:29.217

Modified: 2026-10-15T11:17:17.467

Link: CVE-2026-101215

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T22:15:06Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')