CVE-2026-32657

HighCVSS 7.3/10Last modified Aug 20, 2026

Description

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex Rack version 4.5.4 and prior versions, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-61

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	AppSync	< 4.6.0.4 or later
Dell	Metro Node	< 4.6.0.4 or later
Dell	UCC Edge	< 3.0.2 or later
Dell	VxRail	< 8.0.330 or later
Dell	PowerMax	< 10.3.1.0 Patch 11248 or later
Dell	Unity	< 5.5.2 or later
Dell	PowerFlex Manager	< 4.5.5 or later
Dell	PowerFlex Intelligent Catalog	< 48.383.00 or later
Dell	PowerFlex Intelligent Catalog	< 48.378.00 or later
Dell	PowerFlex Rack	< 4.5.5 or later

References

https://www.dell.com/support/kbdoc/en-us/000497857/dsa-2026-220-security-update-for-dell-product-vulnerability

Timeline

Published: Aug 18, 2026
Last modified: Aug 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-326588.8Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote ac CVE-2026-32669.8Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to g CVE-2026-326619.3Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote CVE-2026-326625.3Development and test API endpoints are present that mirror production functionality.CVE-2026-326636.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the sa CVE-2026-326657.5In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams CVE-2026-326667.5WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additi CVE-2026-326678.5Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivi CVE-2026-326699.8Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed CVE-2026-326708.5Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation CVE-2026-326726.8Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of servi CVE-2026-326738.7A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator