Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Dell Container Storage Modules lets attackers steal storage admin credentials

CVE-2026-63688 · published 12 days ago
Summary

Versions of Dell Container Storage Modules before 1.18.0 do not properly check who can use a critical storage management service. This gap could let an outside attacker obtain the administrator passwords for every storage system linked to the product. Upgrade to version 1.18.0 or later, or apply Dell's recommended patch, to close the gap.

What to do
  • Update dell dell container storage modules (csm) to version 1.18.0 or later or later.
Affected software
VendorProductAffected versions
dell dell container storage modules (csm) < 1.18.0 or later
Original advisory text
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticat...
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-63688 · NVD
CVE-2026-63688 · MITRE
Track software like this
Free during beta