CVE-2026-22280
📋 TL;DR
Dell PowerScale OneFS contains an incorrect permission assignment vulnerability that allows low-privileged local attackers to cause denial of service. This affects multiple versions of Dell PowerScale OneFS storage systems. Organizations running affected versions are vulnerable to local privilege escalation leading to system disruption.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains elevated privileges and disrupts critical storage services, causing extended downtime and data unavailability.
Likely Case
Malicious insider or compromised low-privileged account causes temporary service disruption on affected storage nodes.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated nodes with quick detection and remediation.
🎯 Exploit Status
Requires local access and low-privileged credentials. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to OneFS 9.5.1.6+, 9.7.1.11+, 9.10.1.4+, or 9.13.0.0+ as appropriate for your version
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000415586/dsa-2026-049-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2026-049. 2. Identify current OneFS version. 3. Download appropriate patch from Dell Support. 4. Apply patch following Dell's update procedures. 5. Reboot affected nodes as required.
🔧 Temporary Workarounds
Restrict Local Access
linuxLimit local console and SSH access to trusted administrators only
# Review and restrict SSH access in /etc/ssh/sshd_config
# Implement strict access controls for console ports
Enhanced Monitoring
linuxMonitor for privilege escalation attempts and unusual local activity
# Enable audit logging: isi audit settings modify --enabled=true
# Monitor system logs for privilege changes
🧯 If You Can't Patch
- Implement strict access controls to limit who has local access to PowerScale systems
- Enable comprehensive logging and monitoring for privilege escalation attempts and unusual local activity
🔍 How to Verify
Check if Vulnerable:
Run 'isi version' to check current OneFS version and compare against affected rangesCheck Version:
isi versionVerify Fix Applied:
After patching, run 'isi version' to confirm version is updated to patched release📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Failed access attempts to restricted resources
- Unexpected process execution with elevated privileges
Network Indicators:
- Multiple failed SSH/local login attempts from same source
- Unusual outbound connections from storage nodes
SIEM Query:
source="powerscale" AND (event_type="privilege_escalation" OR event_type="access_violation")