CVE-2026-22283: Dell PowerFlex Manager, version(s) Version prior to 4

Synopsis

An Inclusion of Functionality from Untrusted Control Sphere vulnerability affects Dell PowerFlex Manager versions prior to 4.8. The flaw is reachable over the network without authentication, though exploitation requires victim interaction and favorable environmental conditions. Successful exploitation gives an attacker access to sensitive information from the affected system. Patched-image rebuilds at versions 4.5.5.2 and 5.1.0.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PowerFlex Manager service over the network; no local or physical access to the host is required.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable code path is accessible to unauthenticated remote requests.

• Victim interactionRequired

  A user must take some action (such as visiting a crafted link or loading attacker-influenced content) for the exploit to complete.

• Attack complexityDetail

  Exploitation depends on conditions beyond the attacker's direct control, such as specific race conditions, memory layout, or environmental state, making reliable exploitation harder than a straightforward request.

Blast Radius

• A successful attacker reads sensitive information stored or processed by PowerFlex Manager, such as configuration data, credentials, or internal system details.
• Confidentiality of the affected host is fully compromised (CVSS C:H), meaning the attacker can access all data the service can reach.
• Integrity of stored data is also fully compromised (CVSS I:H), allowing the attacker to modify persisted configuration or management records.
• Availability of the service is fully compromised (CVSS A:H), meaning the attacker can crash or render PowerFlex Manager unresponsive.