CVE-2026-21417
Published: 27 January 2026
Summary
CVE-2026-21417 is a high-severity Plaintext Storage of a Password (CWE-256) vulnerability in Dell Cloudboost Virtual Appliance. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest).
Deeper analysis
CVE-2026-21417 is a Plaintext Storage of Password vulnerability (CWE-256) affecting Dell CloudBoost Virtual Appliance in versions prior to 19.14.0.0. The issue involves sensitive credentials being stored in plaintext, which could be accessed by an attacker. It has a CVSS v3.1 base score of 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) and was published on 2026-01-27.
A high privileged attacker with remote access could potentially exploit this vulnerability to achieve elevation of privileges. The CVSS vector indicates network accessibility with high attack complexity, no user interaction required, and impacts including low confidentiality and integrity effects alongside high availability disruption, though the description emphasizes privilege escalation as the primary outcome.
Dell has addressed this issue in DSA-2026-025, detailed at https://www.dell.com/support/kbdoc/en-us/000419894/dsa-2026-025-security-update-for-dell-cloudboost-virtual-appliance-multiple-vulnerabilities, recommending an update to version 19.14.0.0 or later for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4828
Vulnerability details
Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping from plaintext credential storage (CWE-256) to discovery of unsecured credentials in files.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic or equivalent protection of sensitive data (including credentials) at rest, eliminating the plaintext password storage that enables the described privilege escalation.
Mandates secure generation, storage, and protection of authenticators so that passwords are never maintained in plaintext, directly blocking the CWE-256 weakness in the CloudBoost appliance.
Enforces least-privilege access to credential stores, limiting the impact even if a high-privileged remote attacker reaches the plaintext passwords on the virtual appliance.