CVE-2026-26361

Published Feb 19, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Analysis

Technical impact

Dell Unisphere for PowerMax version 10.2 contains an External Control of File Name or Path vulnerability (CWE‑73). A remote attacker with low privileges can influence the file path requested by the application, enabling a disclosure of sensitive data on the underlying system. The impact is a loss of confidentiality; no evidence of integrity or availability compromise is indicated.

Affected Systems

Dell PowerMax and Dell Unisphere for PowerMax are affected. The specific vulnerable version is 10.2. The affected components include the Unisphere for PowerMax service and its EEM module.

Risk and Exploitability

The CVSS score is 6.5, indicating medium severity, while the EPSS score is below 1 %, meaning the likelihood of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a low‑privileged attacker must have network access to the Dell Unisphere for PowerMax interface to manipulate file paths and read protected files.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

Unisphere for PowerMax

unaffected

Version	Status	Constraints
`N/A`	affected	< 10.3.0.1 or later

Dell

PowerMax

unaffected

Version	Status	Constraints
`N/A`	affected	< 10.3.0.1 or later

Configuration 1 [-]

OR	cpe:2.3:a:dell:unisphere_for_powermax::::::::
	cpe:2.3:a:dell:unisphere_for_powermax:::::eem:::*

No data.

Vendor Product Versions

Dell

Powermax Os

Version	Status	Scheme	Platform
`[0,10.3.0.1)`	affected	generic	—

Dell

Unisphere For Powermax

Version	Status	Scheme	Platform
`[0,10.3.0.1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Dell update for Unisphere for PowerMax issued by Dell (see the Dell security advisory for version 10.2 or later).
Restrict or remove the least‑privileged accounts that have remote access to Unisphere, limiting their ability to request arbitrary file paths.
Configure file system permissions and ensure that the Unisphere service validates or sanitizes any file path inputs before accessing the file system.

Generated by OpenCVE AI on April 17, 2026 at 18:13 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.264% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.dell.com/support/kbdoc/en-us/000429268/dsa-2026-102-dell-unisphere-for-powermax-and-powermax-eem-security-update-for-multiple-vulnerabilities

History

Feb 20, 2026 9:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:dell:unisphere_for_powermax:::::::: cpe:2.3:a:dell:unisphere_for_powermax:::::eem:::*

Feb 20, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell powermax Os Dell unisphere For Powermax
Vendors & Products		Dell Dell powermax Os Dell unisphere For Powermax

Feb 20, 2026 1:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 19, 2026 8:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Weaknesses		CWE-73
References		https://www.dell.com/support/kbdoc/en-us/000429268/dsa-2026-102-dell-unisphere-for-powermax-and-powermax-eem-security-update-for-multiple-vulnerabilities
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`