CVE-2026-21423
📋 TL;DR
Dell PowerScale OneFS has an incorrect default permissions vulnerability that allows high-privileged local attackers to execute arbitrary code, cause denial of service, escalate privileges, or access sensitive information. This affects Dell PowerScale OneFS versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level code execution, data exfiltration, and persistent backdoor installation
Likely Case
Privilege escalation from high-privileged user to root, enabling unauthorized access to sensitive data and system manipulation
If Mitigated
Limited impact due to strict access controls, network segmentation, and monitoring preventing local attacker access
🎯 Exploit Status
Exploitation requires existing high-privileged local access; no public exploit code available at this time
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.10.1.6 or later for 9.10.x branch; 9.12.0.2 or later for 9.11.x/9.12.x branches
Vendor Advisory: https://www.dell.com/support/kbdoc/en-sg/000432452/dsa-2026-038-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Dell Support. 2. Apply the patch following Dell's OneFS update procedures. 3. Reboot the system as required. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Local Access
linuxLimit local access to only essential administrative users and implement strict access controls
# Review and restrict local user accounts
# isi auth users list
# isi auth groups list
# Remove unnecessary high-privileged accounts
Implement Least Privilege
linuxEnsure all users operate with minimum necessary privileges and monitor privileged account usage
# Review privilege assignments
# isi auth roles list
# isi auth privileges list
# Audit privilege assignments regularly
🧯 If You Can't Patch
- Implement strict access controls to limit who has high-privileged local access to the system
- Enable comprehensive logging and monitoring of all privileged account activity and file permission changes
🔍 How to Verify
Check if Vulnerable:
Check OneFS version using 'isi version' command and compare against affected versionsCheck Version:
isi versionVerify Fix Applied:
Run 'isi version' command and verify version is 9.10.1.6 or later (for 9.10.x) or 9.12.0.2 or later (for 9.11.x/9.12.x)📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Unauthorized file permission changes
- Suspicious local user activity from high-privileged accounts
Network Indicators:
- N/A - Local-only vulnerability
SIEM Query:
source="OneFS" AND (event_type="privilege_escalation" OR event_type="permission_change" OR user="root" OR user="admin")