CVE-2026-107526 · Vendor
NO FIX YET
Dell PowerStore storage appliances fail to validate input in the management interface, so a low-privileged logged-in user can store malicious script there. Other users who view the stored content can then have script run in their browser, which may let an attacker act as them in the management interface.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running Dell PowerStore storage appliances with the management interface in use. Exposure requires an authenticated low-privileged account; sources do not name affected firmware versions.
Not affected if auth-required, no-powerstore-deployed
Who cares dell-powerstore, self-hosted, storage
Unknown from the sources.
No fix yet, per the sources.
Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.