{"id":"CVE-2026-35065","state":"PUBLISHED","title":"Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network acce","description":"Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.","publishedAt":"2026-06-17T14:42:31.270Z","updatedAt":"2026-06-25T13:01:12.404Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"dell"},"assigner":"dell","products":["Dell PowerFlex"],"affected":[{"vendor":"Dell","product":"PowerFlex","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.0.1 or later","versionType":"semver"},{"version":"0","status":"affected","lessThan":"4.5.5.2 or later","versionType":"semver"}]}],"references":["https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/35xxx/CVE-2026-35065.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-35065","state":"PUBLISHED","datePublished":"2026-06-17T14:42:31.270Z","dateUpdated":"2026-06-25T13:01:12.404Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2026-04-01T05:04:41.954Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access."}],"affected":[{"vendor":"Dell","product":"PowerFlex","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.0.1 or later","versionType":"semver"},{"version":"0","status":"affected","lessThan":"4.5.5.2 or later","versionType":"semver"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306: Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateUpdated":"2026-06-25T13:01:12.404Z"},"datePublic":"2026-06-15T06:30:00.000Z","credits":[{"lang":"en","value":"Dell would like to thank brocked200 for reporting this issue.","type":"other"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-17T16:09:44.226124Z","id":"CVE-2026-35065","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-17T16:09:51.140Z"}}]}}}