CVE-2026-26359
Published: 19 February 2026
Summary
CVE-2026-26359 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Dell Unisphere For Powermax. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates file name and path inputs to prevent external control and arbitrary file overwrites by a low-privileged remote attacker.
Remediates the specific flaw in Dell Unisphere for PowerMax through vendor-provided security updates, directly eliminating the vulnerability.
Enforces least privilege to limit the scope and impact of arbitrary file overwrites by restricting low-privileged attacker capabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote arbitrary file overwrite in public-facing Unisphere app directly enables initial access via T1190; facilitates privilege escalation via T1068 and stored data manipulation/corruption via T1565.001.
NVD Description
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.
Deeper analysisAI
CVE-2026-26359 is an External Control of File Name or Path vulnerability (CWE-73) in Dell Unisphere for PowerMax version 10.2. Published on 2026-02-19, the issue has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
A low-privileged attacker with remote network access can exploit this vulnerability without user interaction. Successful exploitation allows the attacker to overwrite arbitrary files on the affected system, potentially enabling further compromise such as privilege escalation, data corruption, or denial of service.
Dell Security Advisory DSA-2026-102, available at https://www.dell.com/support/kbdoc/en-us/000429268/dsa-2026-102-dell-unisphere-for-powermax-and-powermax-eem-security-update-for-multiple-vulnerabilities, addresses this vulnerability along with others in Unisphere for PowerMax and PowerMax EEM, providing a security update for mitigation.
Details
- CWE(s)