CVE-2026-107522

HighCVSS 7.2/10Last modified Nov 14, 2026

Description

Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	PowerStore 500T	< 5.1.0.0-2798105 or later
Dell	PowerStore 1000T	< 5.1.0.0-2798105 or later
Dell	PowerStore 1200T	< 5.1.0.0-2798105 or later
Dell	PowerStore 3000T	< 5.1.0.0-2798105 or later
Dell	PowerStore 3200Q	< 5.1.0.0-2798105 or later
Dell	PowerStore 3200T	< 5.1.0.0-2798105 or later
Dell	PowerStore 5000T	< 5.1.0.0-2798105 or later
Dell	PowerStore 5200Q	< 5.1.0.0-2798105 or later
Dell	PowerStore 5200T	< 5.1.0.0-2798105 or later
Dell	PowerStore 7000T	< 5.1.0.0-2798105 or later
Dell	PowerStore 9000T	< 5.1.0.0-2798105 or later
Dell	PowerStore 9200T	< 5.1.0.0-2798105 or later
Dell	PowerStore 1500	< 5.1.0.0-2798105 or later
Dell	PowerStore 5500	< 5.1.0.0-2798105 or later
Dell	PowerStore 9500	< 5.1.0.0-2798105 or later

References

https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities

Timeline

Published: Nov 13, 2026
Last modified: Nov 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1075238.7Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentiall CVE-2026-1075248.8Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially lead CVE-2026-1075255.3Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain ser CVE-2026-1075264.6Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerabili CVE-2026-107532.7The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing low CVE-2026-107548.6Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to CVE-2026-107552.7The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allow CVE-2026-107567.7TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to CVE-2026-1075647.5An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause CVE-2026-1075655.1A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unif CVE-2026-1075666.5Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.CVE-2026-1075677.5Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attack