CVE-2026-32804: Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability

Synopsis

An improper authentication vulnerability in Dell PowerFlex Manager allows an unauthenticated attacker on the same network segment to bypass authentication controls entirely. The CVSS vector (AV:A/PR:N/UI:N) indicates the attacker needs adjacent network access but no credentials and no victim interaction. Successful exploitation gives the attacker the ability to tamper with managed infrastructure and disrupt availability of the PowerFlex environment. Patched-image rebuilds at versions 4.5.5.2 and 5.1.0.1 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment such as the same LAN, VLAN, or VPN; over-the-internet exploitation is not directly possible without that adjacency.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability exists in the authentication layer itself, so an anonymous attacker can reach protected functionality.

• Victim interactionNot required

  Exploitation is entirely attacker-driven; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable without needing to satisfy special conditions, race a timer, or manipulate memory layout.

Blast Radius

• Attacker bypasses authentication and gains unauthorized control over PowerFlex Manager, allowing modification of storage, compute, or network configurations managed by the platform.
• Attacker disrupts availability of the PowerFlex Manager service and the infrastructure resources it orchestrates, causing outages to dependent workloads.
• Because confidentiality impact is rated None in the CVSS vector, direct data exfiltration from the manager itself is not the primary risk; the integrity and availability of managed infrastructure are the principal concerns.