Tia N.List

Reported by 5 outlets

Dell asks admins to patch max severity CSM flaws as soon as possible

hot0.0
Why this score
Breadth
2.00 / 2.0 · 5 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
4.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.59 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
bleepingcomputer.comdeafnews.itdell.comthehackernews.comlinuxmint.hu CVE-2026-63688CVE-2026-63692 desk first seen 11d ago

Desk analysis

Dell patched six critical flaws in Container Storage Modules (CSM), the layer that connects Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays to Kubernetes through the Container Storage Interface. Two are CVSS 10.0, CVE-2026-63688 and CVE-2026-63692, both in the CSM Authorization security module and both rooted in missing authentication for critical functions.

CVE-2026-63688 lets an unauthenticated remote attacker read storage backend administrator credentials for all registered arrays and bypass authorization for full administrative control over the storage infrastructure. CVE-2026-63692, in the authorization proxy and tenant service, also yields admin privileges by bypassing authentication controls. Dell warns that a successful attacker can gain complete administrative control over the authorization service and manipulate storage resources across all tenants. Versions before 1.17.0 are affected.

No exploitation is confirmed in the advisory. Watch for exposed CSM authorization endpoints, for credential rotation on storage backends after patching since the credential-theft path is direct, and for scanning activity that fingerprints CSM deployments now that the flaw details are public.

Timeline

  1. original reporting

    Dell asks admins to patch max severity CSM flaws as soon as possible

    bleepingcomputer.com · 11d ago · October 2nd, 2026

    Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. CSM supports Dell's primary storage platforms (PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT), and it extends the capabilities of the standard Container Storage Interface (CSI) drivers for Kubernetes. In a security advisory published on Thursday, Dell said that both critical security flaws were found in the Dell CSM Authorization security module and stem from "missing authentication for critical functions" weaknesses. The first (tracked as CVE-2026-63688) allows unauthenticated remote attackers to access storage backend administrator credentials for all registered storage arrays and bypass authorization to gain full administrative control over the storage infrastructure. Successful exploitation of the second flaw (CVE-2026-63692), present in the authorization proxy and tenant service, also allows threat actors to gain admin privileges by bypassing authentication controls. "This vulnerability is considered critical as it enables an unauthenticated attacker to gain complete administrative control over the authorization service, potentially allowing unauthorized access to and manipulation of storage resources across all tenants," Dell warned . The same day, the company also patched four additional critical-severity Dell CSM security issues that remote attackers can also exploit without privileges to gain

  2. update from deafnews.it

    Dell patches two CVSS 10 flaws in Container Storage Modules. Unauthenticated attackers can bypass access controls and gain full administrati

    deafnews.it · 11d ago · October 2nd, 2026

    Unauthenticated attackers can bypass access controls and gain full administrati

    via Mastodon https://deafnews.it/en/article/dell-csm-two-cvss-10-flaws-grant-attackers-full-administrative-control

  3. update from www.dell.com

    🤖 Dell patches two max-severity (CVSS 10.0) flaws in Container Storage Modules (CSM) Authorization v2.4.0, which connects Dell storage array

    www.dell.com · 11d ago · October 2nd, 2026

    🤖 Dell patches two max-severity (CVSS 10.0) flaws in Container Storage Modules (CSM) Authorization v2.4.0, which connects Dell storage array

    via Mastodon https://www.dell.com/support/kbdoc/en-us/000515771

  4. update from www.bleepingcomputer.com

    Dell has released important security updates for its storage software. If your business uses these systems, please check for updates immedia

    www.bleepingcomputer.com · 11d ago · October 2nd, 2026

    Dell has released important security updates for its storage software. If your business uses these systems, please check for updates immedia

    via Mastodon https://www.bleepingcomputer.com/news/security/new-max-severity-dell-csm-flaws-give-hackers-admin-privileges/

  5. mentioned by thehackernews.com

    🤖 Dell Container Storage Modules (CSM): 6 critical flaws, incl. CVE-2026-63688 and CVE-2026-63692 (CVSS 10.0). Missing authentication lets a

    thehackernews.com · 11d ago · October 2nd, 2026

  6. update from linuxmint.hu

    Dell CSM flaws allow remote admin/root privileges. Versions before 1.17.0 are affected.

    linuxmint.hu · 10d ago · October 3rd, 2026

    Versions before 1.17.0 are affected — do you run this, have you updated yet? Switch to

    via Mastodon https://linuxmint.hu/hir/2026/10/dell-csm-sebezhetosegek-hitelesites-nelkuli-admin-hozzaferes-es-root-jog-kubernetes-node

  7. update from www.bleepingcomputer.com

    # Dell asks admins to patch max severity # CSM flaws as soon as possible https://www. bleepingcomputer.com/news/secu rity/new-max-severity-d

    www.bleepingcomputer.com · 10d ago · October 3rd, 2026

    Dell asks admins to patch max severity # CSM flaws as soon as possible https://www.

Covered in

digest 2026-10-03

Source on GitHub