CVE-2026-22283
Dell Powerflex Manager ≤ 4.8.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-22283 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Dell Powerflex Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Dependencies and Development Tools (T1195.001); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-37726
Vulnerability Data
Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-829 directly describes inclusion of untrusted dependencies/functionality, mapping to compromise of software dependencies.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches to eliminate the Inclusion of Functionality from Untrusted Control Sphere flaw in PowerFlex Manager <5.1.0.1.
Enforces authentication and access control decisions so that unauthenticated remote actors cannot reach the vulnerable code path that leads to information disclosure.
Boundary protection mechanisms can restrict or deny the remote network access required to exploit the unauthenticated inclusion vulnerability.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Pre-acquisition integrity/authenticity checks directly prevent inclusion of untrusted code.
Supply-chain program directly governs inclusion of third-party executable code.
Contractual requirements can mandate trusted sources and integrity checks for included functionality.
Supplier risk assessment explicitly covers risks from their products and libraries.
Critical-supplier assessment reduces risk of importing executable functionality from untrusted parties.
Secure SDLC practices include dependency vetting and trusted-source policies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By requiring suppliers to propagate security requirements and to disclose component provenance, the control limits the inclusion of functionality obtained from untrusted third-party sources without oversight.
Blocking domains that serve malware or untrusted scripts prevents the browser from automatically including functionality from an attacker-controlled source.