CVE-2026-49502: Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication vulnerability

Synopsis

An improper authentication vulnerability in Dell PowerFlex Manager allows an unauthenticated attacker on the same network segment to bypass authentication entirely. Reachable from an adjacent network (such as a shared LAN or VPN), the flaw requires no credentials and no victim interaction to exploit. Successful exploitation gives an attacker access to sensitive information managed by PowerFlex Manager, with no patch-barrier standing in the way. Patched-image rebuilds at versions 4.5.5.2 and 5.1.0.1 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as a shared LAN, VLAN, or VPN segment; direct internet exposure is not required but local network access is necessary.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability can be reached by any unauthenticated party on the adjacent network.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is fully attacker-driven with no social-engineering step.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, memory layout dependencies, or other environmental factors need to align.

Blast Radius

• An attacker reads sensitive information managed by PowerFlex Manager, which may include infrastructure credentials, configuration secrets, and operational metadata.
• The vulnerability carries a High confidentiality impact (C:H on CVSS), meaning a successful attacker gains broad read access to protected data, not just isolated fragments.
• Because the scope is changed (S:C), the disclosure can extend beyond the PowerFlex Manager process itself to dependent systems or downstream infrastructure components that trust its data.