Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Dell PowerStore could let unauthenticated users read system data

CVE-2026-58574 · published 2 months ago
Summary

The PowerStore 500t, 1000t, 1200t, 3000t, and 3200q models allow anyone with network access to the management console to view internal files and passwords. This could give a malicious person full control over the storage array. Apply Dell's security update and limit network access to the management interface to trusted hosts only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dell powerstore 500t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 1000t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 1200t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 3000t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 3200q < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 3200t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 5000t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 5200q < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 5200t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 7000t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 9000t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
dell powerstore 9200t < 4.1.0.6-2771237 or later
< 4.3.1.2-2771239 or later
Original advisory text
Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially explo...
Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published31 Aug 2026
Updated30 Oct 2026
First seen31 Aug 2026
Sources
CVE-2026-58574 · NVD
CVE-2026-58574 · MITRE
Track software like this
Free during beta