CVE-2026-35065: Dell PowerFlex Manager, version(s) [Versions], contain(s) a Missing Authentication for Critical Function vulnerability

Synopsis

Missing authentication for a critical function in Dell PowerFlex Manager allows an unauthenticated attacker on the same network segment to invoke privileged operations without providing any credentials. The vulnerability is reachable from an adjacent network (such as a LAN or shared management VLAN) and requires no user interaction or prior authentication. Successful exploitation gives the attacker full code execution, the ability to read or alter managed infrastructure data, and the ability to crash the service. Patched-image rebuilds at versions 4.5.5.2 and 5.1.0.1 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The vulnerable service must be reachable from an adjacent network such as a local LAN, shared management VLAN, or VPN segment; remote internet exposure is not required but adjacency is the key prerequisite.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is precisely that a critical function is exposed without any authentication gate.

• Victim interactionNot required

  The attacker sends crafted requests directly to the service and no user action or victim click is required to trigger exploitation.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors need to be satisfied.

Blast Radius

• Attacker executes arbitrary code or scripts on the PowerFlex Manager host, gaining a foothold inside the infrastructure management plane.
• Attacker reads sensitive configuration data, credentials, and operational state managed by PowerFlex Manager.
• Attacker modifies infrastructure configuration or persisted management data, potentially altering storage or compute provisioning.
• Attacker crashes the PowerFlex Manager service, disrupting orchestration and management operations for attached infrastructure.