CVE-2026-22279
Dell Powerscale Onefs ≤ 9.13.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NSummary
CVE-2026-22279 is a medium-severity Insufficient Logging (CWE-778) vulnerability in Dell Powerscale Onefs. Its CVSS base score is 4.3 (Medium).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AU-12 (Audit Record Generation) and AU-2 (Event Logging) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22279 is an insufficient logging vulnerability (CWE-778) in Dell PowerScale OneFS versions prior to 9.13.0.0. This flaw allows potential information tampering due to inadequate logging mechanisms.
An unauthenticated attacker with remote network access can exploit the vulnerability, which has low attack complexity but requires user interaction. Exploitation leads to low-impact integrity violations, enabling limited tampering with information, with no impact on confidentiality or availability. The CVSS v3.1 base score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Dell's security advisory DSA-2026-049 addresses this vulnerability along with others in PowerScale OneFS, recommending an update to version 9.13.0.0 or later for mitigation. Additional details are available at https://www.dell.com/support/kbdoc/en-us/000415586/dsa-2026-049-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3788
Vulnerability Data
Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information tampering.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AU-12 requires the system to generate audit records for defined events, structurally eliminating the root condition of insufficient logging.
AU-2 requires identification and logging of security-relevant event types, directly stopping omission of critical events.
AU-3 mandates that audit records contain the specific details needed to understand what occurred, preventing incomplete event descriptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Insufficient logging directly prevents generation of the incident data/metadata that RS.AN-07 requires, so the weakness starves collection/preservation completely in both directions.
Insufficient logging largely blinds event analysis by omitting the critical details needed to understand adverse activities.
Insufficient logging starves the multiple log sources and SIEM correlation that DE.AE-03 relies on, largely defeating its ability to operate while the logging gap removes most of the correlation outcome's value.
Insufficient logging starves impact/scope estimation of the event details required to produce accurate estimates, removing most of the outcome's value while leaving limited non-log avenues intact.
Insufficient logging starves DE.AE-06 of the event data that must be delivered to staff/tools, removing most of the outcome's value while the delivery mechanisms themselves remain intact.
Insufficient logging starves incident declaration of the event details needed to evaluate criteria, removing most of the outcome's efficacy in both directions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating comprehensive event logging with user IDs, timestamps, and access attempts directly eliminates the absence of audit trails that would otherwise allow undetected exploitation.
Mandating retention of monitoring records and real-time or periodic logging directly counters insufficient logging by ensuring security-relevant events are captured.
Trustworthy timestamps ensure that security-relevant events are recorded with accurate chronology, improving the usefulness of logs for detecting and investigating incidents.
Requiring suppliers to maintain and share audit trails and event records ensures that security-relevant activity is captured, reducing the impact of insufficient logging within the supplier's systems.
Mandating systematic logging of incident activities and evidence handling ensures security-relevant events are recorded rather than omitted, directly reducing the chance that attacks go undetected due to missing audit trails.
Mandating detailed recording of every assessment and decision creates an auditable trail that counters the absence of security-relevant logging.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248726 The OL 8 System must take appropriate action when an audit processing failure occurs. prevents CWE-778
- V-248728 The OL 8 audit system must take appropriate action when the audit storage volume is full. prevents CWE-778
Oracle Linux 9 (1 rule)
- V-271579 OL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778
RHEL 8 (4 rules)
- V-230390 The RHEL 8 System must take appropriate action when an audit processing failure occurs. prevents CWE-778
- V-230439 Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record. prevents CWE-778
- V-230455 Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record. prevents CWE-778
RHEL 9 (1 rule)
- V-258153 RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778