CVE-2026-68862

MediumCVSS 6.6/10Last modified Nov 12, 2026

Description

Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	Terraform Provider for Dell PowerFlex	< 1.9.0 or later

References

https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-688637.5Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with re CVE-2026-688666.5PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release CVE-2026-688686.5The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections CVE-2026-68879.8Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated rem CVE-2026-688705.3The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through th CVE-2026-688716.5The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agn CVE-2026-688726.5The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection o CVE-2026-688735.5Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclos CVE-2026-688745.7Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network.CVE-2026-688757.8Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally.CVE-2026-688768.0Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges over a net CVE-2026-688777.8Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally.