{"id":"CVE-2026-107526","kind":"vulnerability","aliases":["CVE-2026-107526"],"related":[],"title":"Dell PowerStore: improper input validation enables stored cross-site scripting","description":"Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface.","summary":"Dell PowerStore storage appliances fail to validate input in the management interface, so a low-privileged logged-in user can store malicious script there. Other users who view the stored content can then have script run in their browser, which may let an attacker act as them in the management interface.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell-powerstore","self-hosted","storage","vendor"],"not_affected_if":["auth-required","no-powerstore-deployed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T13:17:40+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","triaged_at":"2026-11-13T13:48:09+00:00","updated_at":"2026-11-13T13:48:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T13:48:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell PowerStore: improper input validation enables stored cross-site scripting","impact":"medium","summary":"Dell PowerStore storage appliances fail to validate input in the management interface, so a low-privileged logged-in user can store malicious script there. Other users who view the stored content can then have script run in their browser, which may let an attacker act as them in the management interface.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dell-powerstore","storage","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"stored script runs in admins' management sessions, enabling account actions","analyst_note":"Find Dell's advisory for CVE-2026-107526 to get affected and fixed PowerStore firmware versions and any workaround.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-powerstore-deployed","auth-required"],"who_is_affected":"Organizations running Dell PowerStore storage appliances with the management interface in use. Exposure requires an authenticated low-privileged account; sources do not name affected firmware versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4504,"output_tokens":452,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107526':14A,17A '-2026':13A,16A 'act':72B 'applianc':29B 'attack':71B,92C 'authent':88C 'browser':66B 'contain':81C 'content':58B 'could':93C 'cross':9A,102C 'cross-sit':8A,101C 'cve':12A,15A 'dell':1A,19B,26B,79C 'dell-powerstor':18B 'enabl':6A 'exploit':94C 'fail':30B 'host':23B 'improp':3A,83C 'input':4A,33B,84C 'interfac':37B,78B,108C 'lead':98C 'let':69B 'log':44B 'logged-in':43B 'low':41B,90C 'low-privileg':40B,89C 'malici':49B 'manag':36B,77B,107C 'may':68B 'potenti':97C 'powerstor':2A,20B,27B,80C 'privileg':42B,91C 'run':63B 'script':11A,50B,62B,104C 'self':22B 'self-host':21B 'site':10A,103C 'storag':24B,28B 'store':7A,48B,57B,100C 'user':46B,53B 'valid':5A,32B,85C 'vendor':25B 'view':55B 'vulner':86C,96C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerStore storage appliances with the management interface in use. Exposure requires an authenticated low-privileged account; sources do not name affected firmware versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dellpowerstore","medium","selfhosted","storage","vendor"],"campaign_type":null,"search_a":"'-107526':14A,17A '-2026':13A,16A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'dell':1A 'enabl':6A 'improp':3A 'input':4A 'powerstor':2A 'script':11A 'site':10A 'store':7A 'valid':5A","search_b":"'act':72B 'applianc':29B 'attack':71B 'browser':66B 'content':58B 'dell':19B,26B 'dell-powerstor':18B 'fail':30B 'host':23B 'input':33B 'interfac':37B,78B 'let':69B 'log':44B 'logged-in':43B 'low':41B 'low-privileg':40B 'malici':49B 'manag':36B,77B 'may':68B 'powerstor':20B,27B 'privileg':42B 'run':63B 'script':50B,62B 'self':22B 'self-host':21B 'storag':24B,28B 'store':48B,57B 'user':46B,53B 'valid':32B 'vendor':25B 'view':55B","search_c":"'attack':92C 'authent':88C 'contain':81C 'could':93C 'cross':102C 'cross-sit':101C 'dell':79C 'exploit':94C 'improp':83C 'input':84C 'interfac':108C 'lead':98C 'low':90C 'low-privileg':89C 'manag':107C 'potenti':97C 'powerstor':80C 'privileg':91C 'script':104C 'site':103C 'store':100C 'valid':85C 'vulner':86C,96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107526","severity":null,"published_at":"2026-11-13T13:17:40+00:00","modified_at":"2026-11-13T13:17:40+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","fetched_at":"2026-11-13T13:46:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}