Dell PowerScale OneFS includes an incorrect privilege assignment that can be leveraged by a low‑privileged attacker who possesses local access to elevate their privileges. The flaw is a direct privilege escalation weakness (CWE‑266) that permits an attacker to gain higher system rights without requiring remote exploitation or additional credentials. The impact is an increase in an attacker’s capabilities, potentially exposing sensitive data and enabling further attacks.

Affected products are Dell PowerScale OneFS firmware versions earlier than 9.10.1.6 and those in the 9.11.0.0 through 9.12.0.1 range. Users running any of these builds should review version details before applying remediation.

The CVSS base score of 6.7 reflects moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at the time of this analysis. The likely attack vector requires local access, meaning the attacker must already be authenticated as a low‑privileged user on the system to attempt escalation. Given the limited exploit probability but potentially serious outcome, immediate remediation is recommended.