CVE-2026-28265
Published: 01 April 2026
Summary
CVE-2026-28265 is a medium-severity Path Traversal: '.../...//' (CWE-35) vulnerability in Dell Powerstoreos. Its CVSS base score is 4.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Stored Data Manipulation (T1565.001); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-28265 is a Path Traversal vulnerability (CWE-22 and CWE-35) in the Service user component of Dell PowerStore. Published on 2026-04-01, it carries a CVSS v3.1 base score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), indicating a medium severity issue with low complexity and privileges required but no confidentiality impact.
A low-privileged attacker with local access to PowerStore can exploit this vulnerability to modify arbitrary system files. Successful exploitation could compromise system integrity and availability, though it requires physical or local network proximity and does not enable remote code execution or privilege escalation beyond the attacker's initial access level.
Dell's security advisory DSA-2026-157 details a security update for PowerStore addressing this and multiple other vulnerabilities. Practitioners should consult the advisory at https://www.dell.com/support/kbdoc/en-us/000444169/dsa-2026-157-dell-powerstore-t-security-update-for-multiple-vulnerabilities for patch deployment instructions and affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17824
Vulnerability details
PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables direct modification of arbitrary system files, mapping to stored data manipulation for integrity/availability impact without RCE or further priv esc.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents path traversal exploitation by validating and sanitizing file path inputs to the Service user component.
Enforces approved access authorizations to block low-privileged Service user from modifying arbitrary system files.
Limits damage from exploitation by restricting Service user privileges to only necessary system resources and files.