CVE-2026-21423
Dell Powerscale Onefs ≤ 9.10.1.6
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-21423 is a medium-severity Incorrect Default Permissions (CWE-276) vulnerability in Dell Powerscale Onefs. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9398
Vulnerability Data
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to code execution, denial of service, elevation of privileges,…
more
and information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect default permissions (CWE-276) on service-related files directly enables T1574.010 for local privilege escalation or code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires least-privilege defaults so that incorrect permissions cannot be shipped or left in place on OneFS.
Enforces access-control policy on every local object, blocking the high-privileged local attacker from exploiting the erroneous defaults.
Mandates secure configuration settings, including correct default file-system permissions, eliminating the CWE-276 condition at deployment time.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly require correct default file permissions.
Defining and enforcing least-privilege access permissions directly prevents overly permissive defaults at install time.
Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.
Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Standard templates that restrict access to utility programs and host parameter settings prevent the assignment of overly permissive default permissions on critical resources.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Windows Server 2016 (1 rule)
- V-224833 Permissions for program file directories must conform to minimum requirements. via CWE-276
Windows Server 2019 (2 rules)
- V-205735 Windows Server 2019 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-205736 Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276
Windows Server 2022 (2 rules)
- V-254252 Windows Server 2022 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-254253 Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276