CVE-2026-35065

HIGH 8.8

Published 2026-06-17 · Last modified 2026-06-25

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.

ELEVATED IMPACT

Severe if exploited (CVSS 8.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 25th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.8CVSS 3.1 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Must sit on the same / adjacent network
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Dell

Products Powerflex

Weakness (CWE)

CWE-306: Missing authentication

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities vendor-advisory

Sources: NVD · CVE.org · EPSS