{"id":"CVE-2026-116417","kind":"vulnerability","aliases":["CVE-2026-116417"],"related":[],"title":"Dell PowerScale InsightIQ: weak password rules let adjacent attackers reach data","description":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access.","summary":"Dell PowerScale InsightIQ versions 6.3.0 through 6.4.0 enforce weak password requirements. An unauthenticated attacker on the adjacent network could gain unauthorized access and disclose information.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerScale InsightIQ","fixed":["6.4.1"],"affected":">= 6.3.0, <= 6.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["dell-powerscale","insightiq","self-hosted","storage","vendor"],"not_affected_if":["outside-affected-versions"],"how_to_check":"Check the installed InsightIQ version; 6.3.0 through 6.4.0 is affected, 6.4.1 or later is fixed. Dell does not name the specific password policy setting, so also review InsightIQ account passwords for weak ones if you cannot upgrade yet.","fix":"Upgrade PowerScale InsightIQ to 6.4.1 or later (InsightIQ Downloads Area).","status":"open","published_at":"2026-11-13T09:17:32+00:00","first_seen_at":"2026-11-13T09:49:52+00:00","triaged_at":"2026-11-13T09:51:56+00:00","updated_at":"2026-11-13T09:54:22+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-13T09:51:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell PowerScale InsightIQ: weak password rules let adjacent attackers reach data","impact":"high","summary":"Dell PowerScale InsightIQ versions 6.3.0 through 6.4.0 enforce weak password requirements. An unauthenticated attacker on the adjacent network could gain unauthorized access and disclose information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dell-powerscale","insightiq","storage"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains unauthorized access and discloses sensitive information","analyst_note":"Confirm the fixed version and the specific password requirement flaw from Dell's security advisory for CVE-2026-116417.","how_to_check":"- Check the installed InsightIQ version against the affected range 6.3.0 through 6.4.0.\n- Review the InsightIQ user accounts and password policy settings: unknown if the sources name a specific setting.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams running Dell PowerScale InsightIQ in the 6.3.0 to 6.4.0 range, reachable from the adjacent network. The sources do not say which configurations or accounts are involved, so unknown beyond the version range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4563,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the specific password requirement flaw from Dell's security advisory for CVE-2026-116417.","search":"'-116417':14A,17A '-2026':13A,16A '6.3.0':33B,58C '6.4.0':35B,60C 'access':50B,73C,85C 'adjac':8A,45B,71C 'attack':9A,42B,69C 'contain':61C 'could':47B,74C 'cve':12A,15A 'data':11A 'dell':1A,21B,29B,54C 'dell-powerscal':20B 'disclos':52B 'disclosur':82C 'enforc':36B 'exploit':76C 'gain':48B 'host':26B 'inform':53B,81C 'insightiq':3A,19A,23B,31B,56C 'lead':79C 'let':7A 'network':46B,72C 'password':5A,38B,64C 'potenti':75C 'powerscal':2A,22B,30B,55C 'powerscale':18A 'reach':10A 'requir':39B,65C 'rule':6A 'self':25B 'self-host':24B 'storag':27B 'unauthent':41B,68C 'unauthor':49B,84C 'vendor':28B 'version':32B,57C 'vulner':66C,78C 'weak':4A,37B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerScale InsightIQ 6.3.0 through 6.4.0. Exploitation needs an attacker on the adjacent network (same segment), with no login. Dell says only 'weak password requirements' and does not say which rule or accounts. Anyone on 6.4.1 or later, or with no InsightIQ, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T09:54:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","run_id":3846},"products":{"at":"2026-11-13T09:54:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","run_id":3846},"who_affected":{"at":"2026-11-13T09:54:22Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","run_id":3846}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["insightiq","powerscaleinsightiq"],"ptokens":["insightiq","powerscale"],"labels":["dellpowerscale","high","insightiq","selfhosted","storage","vendor"],"campaign_type":null,"search_a":"'-116417':14A,17A '-2026':13A,16A 'adjac':8A 'attack':9A 'cve':12A,15A 'data':11A 'dell':1A 'insightiq':3A,19A 'let':7A 'password':5A 'powerscal':2A 'powerscale':18A 'reach':10A 'rule':6A 'weak':4A","search_b":"'6.3.0':33B '6.4.0':35B 'access':50B 'adjac':45B 'attack':42B 'could':47B 'dell':21B,29B 'dell-powerscal':20B 'disclos':52B 'enforc':36B 'gain':48B 'host':26B 'inform':53B 'insightiq':23B,31B 'network':46B 'password':38B 'powerscal':22B,30B 'requir':39B 'self':25B 'self-host':24B 'storag':27B 'unauthent':41B 'unauthor':49B 'vendor':28B 'version':32B 'weak':37B","search_c":"'6.3.0':58C '6.4.0':60C 'access':73C,85C 'adjac':71C 'attack':69C 'contain':61C 'could':74C 'dell':54C 'disclosur':82C 'exploit':76C 'inform':81C 'insightiq':56C 'lead':79C 'network':72C 'password':64C 'potenti':75C 'powerscal':55C 'requir':65C 'unauthent':68C 'unauthor':84C 'version':57C 'vulner':66C,78C 'weak':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116417","severity":null,"published_at":"2026-11-13T09:17:32+00:00","modified_at":"2026-11-13T09:17:32+00:00","first_seen_at":"2026-11-13T09:49:52+00:00","fetched_at":"2026-11-13T09:49:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116417:3846","url":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","severity":null,"published_at":"2026-11-13T09:54:22+00:00","modified_at":"2026-11-13T09:54:22+00:00","first_seen_at":"2026-11-13T09:54:22+00:00","fetched_at":"2026-11-13T09:54:22+00:00","note":"Dell DSA-2026-480: affected 6.3.0-6.4.0, fixed 6.4.1+. Dell gives no detail on which password rule is weak, no workaround. No exploitation or PoC seen; did not search social.","cites":["https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"]}],"documents":[{"id":144512,"url":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","title":"DSA-2026-480: Security Update for Dell PowerScale InsightIQ Multiple Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}