Do Son 
TL;DR
Dell has released PowerStoreT OS 5.1.0.0-2798105 to fix 44 Dell-specific PowerStore vulnerabilities. Seven of them score 9.8 on CVSS v3.1, and most of those sit in the SDNAS file services layer. Several let an unauthenticated attacker crash the NAS node or run code on it.
Advisory DSA-2026-479 covers 13 PowerStore models. The worst bugs include buffer overflows, OS command injection and path traversal in SDNAS. Upgrade every affected appliance to PowerStoreT OS 5.1.0.0-2798105 or later.
Why It Matters
PowerStore arrays hold primary business data, virtual machines and file shares. As a result, a compromised NAS node could expose or destroy that data. Dell’s summary warns the flaws “may be exploited by malicious users to compromise the affected system.”
The volume also stands out. In total, 11 of the Dell PowerStore vulnerabilities score 9.0 or higher, and 16 more fall between 8.0 and 8.8.
How the Attack Works
Critical SDNAS flaws
Seven bugs in SDNAS reach a 9.8 score. For example, CVE-2026-116443 is “a stack-based buffer overflow in the NAS TFTP service.” Dell says it “could allow an unauthenticated remote attacker to cause a denial of service or potential code execution.”
Two command injection flaws, CVE-2026-116448 and CVE-2026-116449, give an attacker with internal network access root commands on the NAS node. Meanwhile, CVE-2026-116439 is a path traversal bug. It could allow an unauthenticated attacker “to read, modify, or delete arbitrary files.” Other critical bugs crash the NFS and NAS file services.
Interconnect and management flaws
CVE-2026-116441 (9.6) is an out-of-bounds write in the storage-processor interconnect driver. A malicious adjacent peer could use it “to execute code with system privileges.” In addition, two 9.1-rated command injection flaws can lead to root access on the appliance. A third 9.1 bug, CVE-2026-111509, uses a weak random number generator. It could let a network attacker “decrypt or tamper with NAS SSH/SFTP sessions.”
High severity flaws
Several 8.8-rated bugs let low-privileged users become administrators through authorization bypass or privilege mismanagement. Another SQL injection flaw could expose “stored private keys” and allow tampering with trusted certificates. Notably, CVE-2026-116442 lets a network attacker replay NDMP authentication “to gain backup and restore control of the appliance.”
XXE and SSRF
CVE-2026-82171 (8.0) is an XML external entity flaw. According to Dell, a high-privileged attacker could use it for “disclosure of sensitive files and root-level compromise of the appliance.” Two SSRF bugs, rated 8.8 and 8.7, let limited users make the appliance reach internal systems.
Lower-rated issues
The remaining bugs include authentication bypass, weak cryptography, stored XSS and server-side request forgery. One flaw even lets an admin “bypass multi-approver controls on critical operations.” Another lets an unauthenticated attacker place misleading text on the real login page for phishing.
Dell’s remediation table lists 44 CVEs in total. However, three of them, CVE-2026-111546, CVE-2026-116445 and CVE-2026-111511, have no description in the advisory. The fix covers every one of these Dell PowerStore vulnerabilities in a single update.
Affected Versions
All PowerStoreT OS 5.1.x versions before 5.1.0.0-2798105 are affected. The advisory lists these models:
- PowerStore 500T, 1000T, 1200T, 3000T, 3200T, 5000T, 5200T, 7000T, 9000T and 9200T
- PowerStore 1500, 5500 and 9500
Patch and Mitigation
Install PowerStoreT OS 5.1.0.0-2798105 or later from each model’s Dell support page. Until then, limit network access to NAS services such as TFTP and NFS. Also, restrict management interfaces to trusted admin networks.
Dell has not reported any exploitation of these Dell PowerStore vulnerabilities. Full details are in Dell security advisory DSA-2026-479.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
