{"id":"CVE-2026-68862","kind":"vulnerability","aliases":["CVE-2026-68862"],"related":[],"title":"Dell Terraform Provider for PowerFlex: command injection on provisioned SDC hosts","description":"Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.","summary":"The Dell Terraform Provider for Dell PowerFlex has an OS command injection flaw in its SDC host provisioning component. A remote attacker with high privileges on the PowerFlex management plane could run arbitrary OS commands on provisioned SDC hosts, potentially fully compromising them.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell-powerflex","self-hosted","terraform","vendor"],"not_affected_if":["no-terraform-provider"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T18:19:49+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:28+00:00","updated_at":"2026-11-11T18:29:28+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T18:29:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Dell Terraform Provider for PowerFlex: command injection on provisioned SDC hosts","impact":"high","summary":"The Dell Terraform Provider for Dell PowerFlex has an OS command injection flaw in its SDC host provisioning component. A remote attacker with high privileges on the PowerFlex management plane could run arbitrary OS commands on provisioned SDC hosts, potentially fully compromising them.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["dell-powerflex","terraform","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary OS commands run on provisioned SDC hosts, full host compromise","analyst_note":"Find the Dell security advisory for CVE-2026-68862 to get affected and fixed provider versions and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-terraform-provider"],"who_is_affected":"Teams that use the Dell Terraform Provider to provision PowerFlex SDC hosts and can reach the PowerFlex management plane. The sources do not name affected provider versions. Teams that do not use this provider are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4601,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68862':14A,17A 'access':93C 'affect':123C 'arbitrari':58B,109C 'attack':47B,91C 'command':6A,36B,60B,78C,111C 'compon':44B,86C 'compromis':67B,121C 'contain':74C 'could':56B,99C 'cve':12A,15A 'dell':1A,19B,27B,31B,68C,72C 'dell-powerflex':18B 'execut':107C 'exploit':101C,116C 'flaw':38B 'full':120C 'fulli':66B 'high':49B,88C 'host':11A,23B,42B,64B,84C,115C,125C 'inject':7A,37B,79C 'lead':104C,118C 'manag':54B,97C 'may':117C 'os':35B,59B,77C,110C 'plane':55B,98C 'potenti':65B,100C 'powerflex':5A,20B,32B,53B,73C,96C 'privileg':50B,89C 'provid':3A,29B,70C 'provis':9A,43B,62B,85C,113C 'remot':46B,90C 'run':57B 'sdc':10A,41B,63B,83C,114C,124C 'self':22B 'self-host':21B 'terraform':2A,24B,28B,69C 'vendor':25B 'vulner':80C,103C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the Dell Terraform Provider to provision PowerFlex SDC hosts and can reach the PowerFlex management plane. The sources do not name affected provider versions. Teams that do not use this provider are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dellpowerflex","medium","selfhosted","terraform","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-68862':14A,17A 'command':6A 'cve':12A,15A 'dell':1A 'host':11A 'inject':7A 'powerflex':5A 'provid':3A 'provis':9A 'sdc':10A 'terraform':2A","search_b":"'arbitrari':58B 'attack':47B 'command':36B,60B 'compon':44B 'compromis':67B 'could':56B 'dell':19B,27B,31B 'dell-powerflex':18B 'flaw':38B 'fulli':66B 'high':49B 'host':23B,42B,64B 'inject':37B 'manag':54B 'os':35B,59B 'plane':55B 'potenti':65B 'powerflex':20B,32B,53B 'privileg':50B 'provid':29B 'provis':43B,62B 'remot':46B 'run':57B 'sdc':41B,63B 'self':22B 'self-host':21B 'terraform':24B,28B 'vendor':25B","search_c":"'access':93C 'affect':123C 'arbitrari':109C 'attack':91C 'command':78C,111C 'compon':86C 'compromis':121C 'contain':74C 'could':99C 'dell':68C,72C 'execut':107C 'exploit':101C,116C 'full':120C 'high':88C 'host':84C,115C,125C 'inject':79C 'lead':104C,118C 'manag':97C 'may':117C 'os':77C,110C 'plane':98C 'potenti':100C 'powerflex':73C,96C 'privileg':89C 'provid':70C 'provis':85C,113C 'remot':90C 'sdc':83C,114C,124C 'terraform':69C 'vulner':80C,103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68862","severity":null,"published_at":"2026-11-11T18:19:49+00:00","modified_at":"2026-11-11T18:19:49+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}