CVE-2026-25907
📋 TL;DR
Dell PowerScale OneFS version 9.13.0.0 has an overly restrictive account lockout mechanism that allows unauthenticated remote attackers to trigger account lockouts, potentially causing denial of service. This affects organizations using vulnerable Dell PowerScale storage systems with OneFS management interfaces exposed to untrusted networks.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical administrative accounts become locked out, preventing legitimate administrators from managing storage systems, potentially disrupting business operations until manual intervention.
Likely Case
Attacker repeatedly triggers account lockouts for administrative accounts, causing temporary denial of service for legitimate administrators attempting to access management interfaces.
If Mitigated
With proper network segmentation and access controls, only authorized internal users can reach management interfaces, limiting attack surface.
🎯 Exploit Status
The vulnerability description indicates unauthenticated remote attackers can exploit this, suggesting simple attack vectors like repeated authentication attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patch from DSA-2026-095
Restart Required: Yes
Instructions:
1. Download the security patch from Dell Support. 2. Apply the patch following Dell's update procedures. 3. Restart affected PowerScale nodes as required. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to PowerScale management interfaces to trusted internal networks only.
Firewall Rules
allImplement firewall rules to block external access to PowerScale management ports (typically 8080, 9090 for web interfaces).
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach PowerScale management interfaces
- Monitor authentication logs for unusual lockout patterns and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check if running OneFS version 9.13.0.0 via SSH: 'isi version' or web interface System Health page.Check Version:
isi versionVerify Fix Applied:
Verify patch application via 'isi upgrade list' showing applied patches, and confirm version is no longer vulnerable.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by account lockout messages in authentication logs
- Unusual source IPs attempting authentication to management interfaces
Network Indicators:
- High volume of authentication requests to PowerScale management ports from single or multiple sources
- Traffic patterns showing repeated login attempts
SIEM Query:
source="powerscale_logs" AND ("authentication failed" OR "account locked") | stats count by src_ip, user