---
id: "CVE-2026-86355"
page: "https://infrastack.ai/live/CVE-2026-86355"
kind: "vulnerability"
aliases: ["CVE-2026-86355"]
title: "Dell PowerStore: remote user can escalate privileges via file path control"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "PowerStoreT OS", "fixed": ["5.1.0.0-2798105"], "affected": "5.1.x < 5.1.0.0-2798105", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dell-powerstore", "infrastructure", "on-prem", "powerstore", "storage"]
not_affected_if: ["auth-required", "no-powerstore-deployed"]
published_at: "2026-11-13T13:18:29+00:00"
first_seen_at: "2026-11-13T13:46:52+00:00"
updated_at: "2026-11-13T13:49:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86355", "first_seen_at": "2026-11-13T13:46:52+00:00"}, {"source": "analyst", "url": "https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities", "first_seen_at": "2026-11-13T13:49:25+00:00", "cites": ["https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"]}]
exploit_sources: []
---

# Dell PowerStore: remote user can escalate privileges via file path control

Link for people: https://infrastack.ai/live/CVE-2026-86355 (this .md is for agents)

Dell PowerStore storage appliances accept file names or paths that an attacker can control. A remote, logged-in attacker can use this to gain higher privileges on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PowerStoreT OS affected 5.1.x < 5.1.0.0-2798105 fixed 5.1.0.0-2798105

## How to check

In PowerStore Manager, check Settings > Cluster/Software for the PowerStoreT OS version; versions prior to 5.1.0.0-2798105 on the 5.1.x train are affected per Dell. Also review which accounts have login to the management interface, since exploitation needs authentication. Dell's table does not address other OS trains; ask Dell support if you run one.

## Fix

Upgrade PowerStoreT OS to 5.1.0.0-2798105 or later (Dell DSA-2026-479). Dell states no workaround.

## Timeline

- 2026-11-13T13:46:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86355
- 2026-11-13T13:49:25+00:00 analyst https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities — Dell DSA-2026-479 (2026-10-30, rev 1.0) read; lists CVE-2026-86355, fix 5.1.0.0-2798105, no workaround stated. Advisory table lists only the 5.1.x train as affected; other trains not addressed (unknown).

## Documents

- [advisory] DSA-2026-479: Dell PowerStore T Security Update for Multiple Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities

## From the sources

Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_