The vulnerability is caused by storing passwords in clear text within Dell CloudBoost Virtual Appliance firmware prior to version 19.14.0.0. This flaw permits a high‑privileged attacker who obtains remote access to retrieve or modify authentication credentials, which can lead to elevation of privileges. The weakness corresponds to CWE‑256, a flaw that directly compromises credential confidentiality.

All releases of Dell CloudBoost Virtual Appliance before version 19.14.0.0 are affected. The vulnerability applies to every deployment of the appliance that has not been updated to the security package DSA‑2026‑025.

The CVSS v3.1 score of 7.0 denotes medium‑to‑high severity. The EPSS probability is recorded as less than 1 %, indicating a currently low chance of exploitation, but the existence of plaintext credential storage increases risk if discovered. The vulnerability is not listed in the CISA KEV catalog, so no publicly confirmed exploit is known. Exploitation requires remote access and high‑privilege credentials.