Dell PowerScale OneFS contains an execution with unnecessary privileges vulnerability that allows a high‑privileged local attacker to gain additional privileges, effectively elevating their rights on the system. The flaw is tied to CWE‑250, indicating that the operating environment does not properly restrict the execution context of privileged code. As a result, an attacker who already has local access with sufficient permissions can execute operations with higher authority, potentially compromising data confidentiality, integrity, and system control.

Parts of the Dell PowerScale OneFS family are affected. All releases before 9.10.1.6, as well as the 9.11.0.0 through 9.12.0.1 series, fall within the vulnerable range. Organizations using any of these product versions should verify the exact build and plan remediation accordingly.

The CVSS base score of 6.7 reflects a moderate severity risk. The EPSS score of less than 1% suggests that exploitation is currently unlikely but still present. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed widespread exploitation yet. The attack vector is local and requires an attacker to already possess some level of access to the system; once that precondition is met, the privilege escalation can be achieved without additional network exposure.