Dell vulnerabilities
Published CVEs affecting Dell products: 606 record(s), with severity, exploitation and fixes.
Secure Connect Gateway 107Secure Connect Gateway 5.0 - Appliance 104Secure Connect Gateway 5.0 - Application 103Data Domain Operating System 56Powerprotect Data Domain 49Policy Manager For Secure Connect Gateway 36Secure Connect Gateway SCG Policy Manager 36Powerscale Onefs 26OpenManage Server Administrator Managed Node for RHEL 9.4 23OpenManage Server Administrator Managed Node for RHEL 8.10 23Openmanage Server Administrator 23Powerflex Manager 23OpenManage Server Administrator Managed Node for SLES 15 23OpenManage Server Administrator Managed Node (Patch) for Windows 23Wyse Management Suite 22OpenManage Server Administrator Managed Node for Ubuntu 22.04 21Objectscale 20PowerStore 500T 18PowerStore 9000T 18PowerStore 1200T 18PowerStore 3200T 18PowerStore 3000T 18PowerStore 5200Q 18PowerStore 1000T 18PowerStore 5000T 18PowerStore 3200Q 18PowerStore 7000T 18PowerStore 5200T 18PowerStore 9200T 17Powerprotect Dp Series Appliance 17Powerprotect Data Manager 15ThinOS 10 15Powerstoreos 14Container Storage Modules 12Thinos 11Unisphere For Powermax 11Elastic Cloud Storage 11Dell Command Update (DCU) 11Command Update 11Display And Peripheral Manager 11
CVE-2026-40638
Medium · 6.7
CWE-250 May 12, 2026
Execution with Unnecessary Privileges in Dell Insightiq
Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
CVE-2026-35071
High · 8.2
CWE-78 May 12, 2026
OS Command Injection in Dell Insightiq
Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-40636
High · 7.8
CWE-798 May 11, 2026
Use of Hard-coded Credentials in Dell Elastic Cloud Storage
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
CVE-2026-35157
Critical · 9.8
CWE-1236 May 11, 2026
CSV Injection in Dell Elastic Cloud Storage
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
CVE-2026-32658
High · 8.8
CWE-862 May 11, 2026
Missing Authorization in Dell Automation Platform
Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-26946
Medium · 6.7
CWE-269 May 11, 2026
Improper Privilege Management in Dell Elastic Cloud Storage
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerability in the OS. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
CVE-2025-43992
Medium · 5.6
CWE-302 May 11, 2026
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0,...
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replication. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data in transit.
CVE-2026-32803
Low · 3.3
CWE-778 May 8, 2026
Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13…
Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
CVE-2026-27105
High · 7.1
CWE-59 Apr 29, 2026
Link Following in Dell Dell/alienware Purchased Apps
Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write
CVE-2026-35155
High · 7.1
CWE-522 Apr 29, 2026
Insufficiently Protected Credentials in Dell Idrac10 Firmware
Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.
CVE-2026-23773
Medium · 4.3
CWE-918 Apr 29, 2026
Server-Side Request Forgery (SSRF) in Dell Disk Library for mainframe DLm8700
Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
CVE-2026-32655
High · 7.8
CWE-272 Apr 27, 2026
Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least…
Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVE-2026-25908
High · 7.8
CWE-250 Apr 27, 2026
Execution with Unnecessary Privileges in Dell Alienware Command Center
Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCC. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVE-2026-26354
Critical · 9.8
CWE-787 Apr 22, 2026
Out-of-bounds Write in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
CVE-2026-35154
Medium · 6.7
CWE-269 Apr 20, 2026
Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release...
Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege
management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.
CVE-2026-26951
Medium · 6.7
CWE-121 Apr 20, 2026
Stack-based Buffer Overflow in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-26943
High · 7.2
CWE-78 Apr 20, 2026
OS Command Injection in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-26942
High · 7.2
CWE-78 Apr 20, 2026
OS Command Injection in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-24506
High · 7.2
CWE-78 Apr 20, 2026
OS Command Injection in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root.
CVE-2026-24505
High · 7.2
CWE-20 Apr 20, 2026
Improper Input Validation in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-24504
High · 7.2
CWE-20 Apr 20, 2026
Improper Input Validation in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-22761
High · 7.2
CWE-78 Apr 20, 2026
OS Command Injection in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
CVE-2026-26944
High · 8.8
CWE-306 Apr 20, 2026
Missing Authentication for Critical Function in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.
CVE-2026-23774
High · 7.2
CWE-78 Apr 20, 2026
OS Command Injection in Dell Powerprotect Dp Series Appliance
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
CVE-2026-28263
Medium · 4.8
CWE-79 Apr 17, 2026
Cross-site Scripting (XSS) in Dell Powerprotect Data Domain
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.