{"id":"CVE-2026-111547","kind":"vulnerability","aliases":["CVE-2026-111547"],"related":[],"title":"Dell PowerStore: out-of-bounds read can crash service or leak data","description":"Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.","summary":"Dell PowerStore storage arrays contain an out-of-bounds read flaw. An attacker could cause a denial of service or read a limited amount of information.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerStoreT OS","fixed":["5.1.0.0-2798105"],"affected":"5.1.x < 5.1.0.0-2798105","ecosystem":"vendor"}],"ecosystems":[],"tags":["dell-powerstore","self-hosted","storage","vendor"],"not_affected_if":[],"how_to_check":"Check the PowerStoreT OS version on each appliance (PowerStore Manager > Settings > Software, or your usual version listing). Affected: any 5.1.x build prior to 5.1.0.0-2798105 on the models listed in DSA-2026-479.","fix":"Upgrade PowerStoreT OS to 5.1.0.0-2798105 or later (Dell DSA-2026-479). Dell lists no workaround.","status":"open","published_at":"2026-11-13T15:17:30+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","triaged_at":"2026-11-13T15:48:19+00:00","updated_at":"2026-11-13T15:52:22+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-13T15:48:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Dell PowerStore: out-of-bounds read can crash service or leak data","impact":"medium","summary":"Dell PowerStore storage arrays contain an out-of-bounds read flaw. An attacker could cause a denial of service or read a limited amount of information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dell-powerstore","storage"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service crash or limited information disclosure from the appliance","analyst_note":"Check Dell's security advisory for affected PowerStore versions, fixed releases and the attack vector, starting from the NVD entry.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Dell PowerStore storage appliances. The sources do not say which PowerStore versions or configurations are affected, or what network exposure is required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":4498,"output_tokens":391,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Dell's security advisory for affected PowerStore versions, fixed releases and the attack vector, starting from the NVD entry.","search":"'-111547':16A,19A '-2026':15A,18A 'amount':54B 'array':33B 'attack':43B,68C 'bound':6A,39B,64C 'caus':45B 'contain':34B,59C 'could':44B,69C 'crash':9A 'cve':14A,17A 'data':13A 'dell':1A,23B,30B,57C 'dell-powerstor':22B 'denial':47B,76C 'disclosur':82C 'exploit':70C 'flaw':41B 'host':27B 'inform':56B,81C 'lead':74C 'leak':12A 'limit':53B,80C 'os':21A 'out-of-bound':3A,36B,61C 'potenti':73C 'powerstor':2A,24B,31B,58C 'powerstoret':20A 'read':7A,40B,51B,65C 'self':26B 'self-host':25B 'servic':10A,49B,78C 'storag':28B,32B 'vendor':29B 'vulner':66C,72C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerStore T appliances (500T, 1000T, 1200T, 1500, 3000T, 3200Q, 3200T, 5000T, 5200Q, 5200T, 5500, 7000T, 9000T, 9200T, 9500) on PowerStoreT OS 5.1.x prior to 5.1.0.0-2798105. Dell describes an out-of-bounds read that could lead to denial of service or limited information disclosure; the CVSS vector is network, high complexity, no privileges. Dell does not say which component is affected. Anyone not running PowerStore can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T15:52:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3900},"products":{"at":"2026-11-13T15:52:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3900},"who_affected":{"at":"2026-11-13T15:52:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","run_id":3900}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["os","powerstoretos"],"ptokens":["os","powerstoret"],"labels":["dellpowerstore","high","selfhosted","storage","vendor"],"campaign_type":null,"search_a":"'-111547':16A,19A '-2026':15A,18A 'bound':6A 'crash':9A 'cve':14A,17A 'data':13A 'dell':1A 'leak':12A 'os':21A 'out-of-bound':3A 'powerstor':2A 'powerstoret':20A 'read':7A 'servic':10A","search_b":"'amount':54B 'array':33B 'attack':43B 'bound':39B 'caus':45B 'contain':34B 'could':44B 'dell':23B,30B 'dell-powerstor':22B 'denial':47B 'flaw':41B 'host':27B 'inform':56B 'limit':53B 'out-of-bound':36B 'powerstor':24B,31B 'read':40B,51B 'self':26B 'self-host':25B 'servic':49B 'storag':28B,32B 'vendor':29B","search_c":"'attack':68C 'bound':64C 'contain':59C 'could':69C 'dell':57C 'denial':76C 'disclosur':82C 'exploit':70C 'inform':81C 'lead':74C 'limit':80C 'out-of-bound':61C 'potenti':73C 'powerstor':58C 'read':65C 'servic':78C 'vulner':66C,72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111547","severity":null,"published_at":"2026-11-13T15:17:30+00:00","modified_at":"2026-11-13T15:17:30+00:00","first_seen_at":"2026-11-13T15:46:15+00:00","fetched_at":"2026-11-13T15:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111547:3900","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","severity":null,"published_at":"2026-11-13T15:52:22+00:00","modified_at":"2026-11-13T15:52:22+00:00","first_seen_at":"2026-11-13T15:52:22+00:00","fetched_at":"2026-11-13T15:52:22+00:00","note":"Dell DSA-2026-479 (published 2026-10-30) lists this CVE: OOB read, CVSS 8.1 AV:N/AC:H/PR:N. Fix is PowerStoreT OS 5.1.0.0-2798105; no workaround listed, no exploitation reported by Dell. Component not stated; how-to-check version path is generic, not verified. Unknown: whether 4.x branches are affected (table lists only 5.1.x).","cites":["https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","https://advisory.eventussecurity.com/advisory/unauthenticated-attackers-can-execute-code-in-powerstore-sdnas/"]}],"documents":[{"id":146567,"url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities","title":"DSA-2026-479: Dell PowerStore T Security Update for Multiple Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":147290,"url":"https://advisory.eventussecurity.com/advisory/unauthenticated-attackers-can-execute-code-in-powerstore-sdnas/","title":"Eventus: PowerStore SDNAS advisory summary (DSA-2026-479)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}