CVE-2026-76111

HighCVSS 8.8/10Last modified Sep 30, 2026

Description

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

VendorProductVersions
DellPowerStore 500T< 4.1.0.6-2771237 or later
DellPowerStore 1000T< 4.1.0.6-2771237 or later
DellPowerStore 1200T< 4.1.0.6-2771237 or later
DellPowerStore 3000T< 4.1.0.6-2771237 or later
DellPowerStore 3200Q< 4.1.0.6-2771237 or later
DellPowerStore 3200T< 4.1.0.6-2771237 or later
DellPowerStore 5000T< 4.1.0.6-2771237 or later
DellPowerStore 5200Q< 4.1.0.6-2771237 or later
DellPowerStore 5200T< 4.1.0.6-2771237 or later
DellPowerStore 7000T< 4.1.0.6-2771237 or later
DellPowerStore 9000T< 4.1.0.6-2771237 or later
DellPowerStore 9200T< 4.1.0.6-2771237 or later
DellPowerStore 500T< 4.3.1.2-2771239 or later
DellPowerStore 1000T< 4.3.1.2-2771239 or later
DellPowerStore 1200T< 4.3.1.2-2771239 or later
DellPowerStore 3000T< 4.3.1.2-2771239 or later
DellPowerStore 3200Q< 4.3.1.2-2771239 or later
DellPowerStore 3200T< 4.3.1.2-2771239 or later
DellPowerStore 5000T< 4.3.1.2-2771239 or later
DellPowerStore 5200Q< 4.3.1.2-2771239 or later
DellPowerStore 5200T< 4.3.1.2-2771239 or later
DellPowerStore 7000T< 4.3.1.2-2771239 or later
DellPowerStore 9000T< 4.3.1.2-2771239 or later
DellPowerStore 9200T< 4.3.1.2-2771239 or later

References

Timeline

Published
Sep 1, 2026
Last modified
Sep 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-761134.3Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vuCVE-2026-761145.9Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vCVE-2026-76124.7A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. ExCVE-2026-761248.8The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedbCVE-2026-761286.4The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versiCVE-2026-76137.2The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_valueCVE-2026-761315.3Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain CVE-2026-761339.8The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attackeCVE-2026-761373.3Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a rCVE-2026-761398.0A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifCVE-2026-76144.3The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. ThisCVE-2026-761429.3Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthe
CVE-2026-76111: High severity, CVSS 8.8 | Vulnix