A flaw in Dell PowerFlex Manager’s authentication mechanism allows an attacker to gain access without valid credentials. The vulnerability can let an unauthenticated actor interact with the management interface, potentially executing privileged commands, retrieving sensitive data, or modifying configuration settings. The weakness is classified as improper authentication, meaning the system fails to enforce or verify credentials correctly, which could compromise confidentiality, integrity, and availability of the PowerFlex environment.

Dell PowerFlex Manager is the affected product. Specific version numbers are not disclosed in the advisory. Any deployment of the manager component that matches the description of adjacent network access exposure is potentially vulnerable.

The CVSS base score of 8.1 places the issue in the high severity range, and the EPSS score of less than 1% indicates a very low likelihood of exploitation, at least as of this assessment. The vulnerability is not listed in CISA’s KEV catalog. The attack likely requires local or subnet-level network proximity, allowing a non‑authenticated user to reach the manager interface. If successful, the attacker can bypass authentication controls and gain unauthorized access to the PowerFlex management plane.