{"id":"CVE-2026-116418","kind":"vulnerability","aliases":["CVE-2026-116418"],"related":[],"title":"Dell PowerScale InsightIQ: low-privileged user can gain elevated privileges remotely","description":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.","summary":"Dell PowerScale InsightIQ versions 6.3.0 through 6.4.0 have an incorrect authorization flaw. A low-privileged attacker with remote access could potentially escalate their privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerScale InsightIQ","fixed":["6.4.1"],"affected":">= 6.3.0, <= 6.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["dell-powerscale","infrastructure","insightiq","self-hosted","storage"],"not_affected_if":["patched-6.4.1"],"how_to_check":"Check the InsightIQ version in the UI or appliance. Versions 6.3.0 through 6.4.0 are affected; 6.4.1 or later is fixed. Any user account with low privileges that can reach InsightIQ over the network could use it.","fix":"Upgrade PowerScale InsightIQ to 6.4.1 or later (Dell PowerScale InsightIQ Downloads Area)","status":"open","published_at":"2026-11-13T10:17:25+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","triaged_at":"2026-11-13T10:52:44+00:00","updated_at":"2026-11-13T10:53:24+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T10:52:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell PowerScale InsightIQ: low-privileged user can gain elevated privileges remotely","impact":"high","summary":"Dell PowerScale InsightIQ versions 6.3.0 through 6.4.0 have an incorrect authorization flaw. A low-privileged attacker with remote access could potentially escalate their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dell-powerscale","insightiq","storage"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged account gains elevated privileges on the InsightIQ system","analyst_note":"Find Dell's security advisory for this CVE to confirm the fixed version and any configuration requirements; the NVD entry alone does not give them.","how_to_check":"- Check the installed InsightIQ version against the affected range 6.3.0 through 6.4.0\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Dell PowerScale InsightIQ in the affected 6.3.0 to 6.4.0 range, where low-privileged accounts can reach the service remotely. The sources do not describe the specific configuration required. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4552,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Dell's security advisory for this CVE to confirm the fixed version and any configuration requirements; the NVD entry alone does not give them.","search":"'-116418':15A,18A '-2026':14A,17A '6.3.0':34B,59C '6.4.0':36B,61C 'access':49B,73C 'attack':46B,70C 'author':40B,65C 'contain':62C 'could':50B,74C 'cve':13A,16A 'dell':1A,22B,30B,55C 'dell-powerscal':21B 'elev':10A,81C 'escal':52B 'exploit':76C 'flaw':41B 'gain':9A 'host':28B 'incorrect':39B,64C 'infrastructur':24B 'insightiq':3A,20A,25B,32B,57C 'lead':79C 'low':5A,44B,68C 'low-privileg':4A,43B 'potenti':51B,75C 'powerscal':2A,23B,31B,56C 'powerscale':19A 'privileg':6A,11A,45B,54B,69C,83C 'remot':12A,48B,72C 'self':27B 'self-host':26B 'storag':29B 'user':7A 'version':33B,58C 'vulner':66C,78C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerScale InsightIQ 6.3.0 through 6.4.0 to monitor PowerScale storage clusters. An attacker needs a low-privileged account and network access to InsightIQ, and Dell rates attack complexity high. Teams not running InsightIQ, or already on 6.4.1 or later, can skip it.","tier":"B","verified":{"products":{"at":"2026-11-13T10:53:24Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","run_id":3867},"who_affected":{"at":"2026-11-13T10:53:24Z","by":"analyst","doc":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","run_id":3867}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["insightiq","powerscaleinsightiq"],"ptokens":["insightiq","powerscale"],"labels":["dellpowerscale","high","infrastructure","insightiq","selfhosted","storage"],"campaign_type":null,"search_a":"'-116418':15A,18A '-2026':14A,17A 'cve':13A,16A 'dell':1A 'elev':10A 'gain':9A 'insightiq':3A,20A 'low':5A 'low-privileg':4A 'powerscal':2A 'powerscale':19A 'privileg':6A,11A 'remot':12A 'user':7A","search_b":"'6.3.0':34B '6.4.0':36B 'access':49B 'attack':46B 'author':40B 'could':50B 'dell':22B,30B 'dell-powerscal':21B 'escal':52B 'flaw':41B 'host':28B 'incorrect':39B 'infrastructur':24B 'insightiq':25B,32B 'low':44B 'low-privileg':43B 'potenti':51B 'powerscal':23B,31B 'privileg':45B,54B 'remot':48B 'self':27B 'self-host':26B 'storag':29B 'version':33B","search_c":"'6.3.0':59C '6.4.0':61C 'access':73C 'attack':70C 'author':65C 'contain':62C 'could':74C 'dell':55C 'elev':81C 'exploit':76C 'incorrect':64C 'insightiq':57C 'lead':79C 'low':68C 'potenti':75C 'powerscal':56C 'privileg':69C,83C 'remot':72C 'version':58C 'vulner':66C,78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116418","severity":null,"published_at":"2026-11-13T10:17:25+00:00","modified_at":"2026-11-13T10:17:25+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","fetched_at":"2026-11-13T10:47:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116418:3867","url":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","severity":null,"published_at":"2026-11-13T10:53:24+00:00","modified_at":"2026-11-13T10:53:24+00:00","first_seen_at":"2026-11-13T10:53:24+00:00","fetched_at":"2026-11-13T10:53:24+00:00","note":"Dell DSA-2026-480 (read directly: affected 6.3.0-6.4.0, CVSS 7.5 AV:N/AC:H/PR:L; fixed version 6.4.1 came via page-summary tool, so fix left unverified; no workarounds listed). No exploitation or PoC found; VulDB says no exploit.","cites":["https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"]}],"documents":[{"id":144512,"url":"https://www.dell.com/support/kbdoc/en-us/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities","title":"DSA-2026-480: Security Update for Dell PowerScale InsightIQ Multiple Vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}