CVE-2026-54470
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker to remotely exploit improper restriction of XML external entity references (XXE). This could lead to unauthorized access to the system.
Risk Assessment
The risk involves potential unauthorized access to PowerMax array management by a low-privileged attacker, which could result in data leakage or disruption of infrastructure operations.
Recommendation
It is recommended to immediately upgrade Dell Unisphere for PowerMax to a version later than 10.3.0.5 and apply the security patches provided by the vendor.
Other vulnerabilities in Dell Unisphere for PowerMax
See all- CVE-2025-36589High
Dell Unisphere for PowerMax, versions 9.2.4.x, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit this, leading to unauthorized access to data and resources outside the intended control sphere.
- CVE-2026-54469High
Deserialization of untrusted data vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior. A low-privileged attacker with remote access can exploit this to execute arbitrary commands with root privileges.
- CVE-2026-54468Medium
A path traversal vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker with remote access to read arbitrary files on the system.
Original NVD description (English source)
Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.