CVE-2026-86355

HighCVSS 8.3/10Last modified Nov 13, 2026

Description

Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-73

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DellPowerStore 500T< 5.1.0.0-2798105 or later
DellPowerStore 1000T< 5.1.0.0-2798105 or later
DellPowerStore 1200T< 5.1.0.0-2798105 or later
DellPowerStore 3000T< 5.1.0.0-2798105 or later
DellPowerStore 3200Q< 5.1.0.0-2798105 or later
DellPowerStore 3200T< 5.1.0.0-2798105 or later
DellPowerStore 5000T< 5.1.0.0-2798105 or late
DellPowerStore 5200Q< 5.1.0.0-2798105 or later
DellPowerStore 5200T< 5.1.0.0-2798105 or later
DellPowerStore 7000T< 5.1.0.0-2798105 or later
DellPowerStore 9000T< 5.1.0.0-2798105 or later
DellPowerStore 9200T< 5.1.0.0-2798105 or late
DellPowerStore 1500< 5.1.0.0-2798105 or later
DellPowerStore 5500< 5.1.0.0-2798105 or later
DellPowerStore 9500< 5.1.0.0-2798105 or later

References

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-863568.8Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator.CVE-2026-863588.8Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attackerCVE-2026-863598.5Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with reCVE-2026-86367.5IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and crypCVE-2026-863609.6Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuCVE-2026-863618.2Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privilCVE-2026-863628.2Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local accesCVE-2026-863635.5Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileCVE-2026-863644.7Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. A low privileged attaCVE-2026-863654.2Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged attaCVE-2026-86377.8A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authentCVE-2026-863756.2Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated at
CVE-2026-86355: High severity, CVSS 8.3 | Vulnix