CVE-2026-49502

HIGH 7.4

Published 2026-06-17 · Last modified 2026-06-25

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access.

ELEVATED IMPACT

Severe if exploited (CVSS 7.4), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 11th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.4CVSS 3.1 · HIGH

ConfidentialityHigh
IntegrityNone
AvailabilityNone

What an attacker needs

⚠Access: Must sit on the same / adjacent network
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Dell

Products Powerflex

Weakness (CWE)

CWE-287: Improper authentication

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Advisories

https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities vendor-advisory

Sources: NVD · CVE.org · EPSS