Dell PowerScale OneFS Security Advisory: CVE-2026-49501 LPE and CVE-2026-40633 Info Disclosure

Vulnerability Overview Dell PowerScale OneFS contains multiple security vulnerabilities that could be exploited by malicious users to compromise the system. Specifically: 1. CVE-2026-49501 - Description: Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7 and 9.11.0.0 through 9.13.0.2 contain a privilege escalation vulnerability. A local attacker may exploit this vulnerability to escalate privileges. - CVSS Base Score: 6.7 - CVSS Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2. CVE-2026-40633 - Description: Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7 and 9.11.0.0 through 9.13.0.2 contain a vulnerability involving the insertion of sensitive information into log files. A local attacker may exploit this vulnerability to cause information disclosure. - CVSS Base Score: 5.5 - CVSS Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Scope Affected Product: Dell PowerScale OneFS Affected Versions: - 9.5.0.0 through 9.10.1.7 - 9.11.0.0 through 9.13.0.2 Remediation Fixed Versions: - 9.10.1.8 or later - 9.13.1.0 or later Recommended Actions: - It is recommended that all customers adopt the Long Term Support (LTS) 2026 version, specifically the 9.13.1.x code line, to obtain the latest maintenance updates. - For non-root users requiring CLI access, configure the restricted shell as the default login shell. For more information, refer to OneFS Restricted Shell. Additional Information Workarounds and Mitigations: - Configure all non-root users requiring CLI access to use the restricted shell as their default login shell. For more information, refer to OneFS Restricted Shell. Revision History: - Initial Release Date: 2026-06-30 Related Links: - Dell Security Advisories and Notices - Dell Vulnerability Response Policy - CVSS Scoring Guide Legal Disclaimer This security advisory is intended to help users avoid potential issues but does not guarantee applicability to all systems. Dell Technologies is not liable for any direct or indirect losses. Affected Products Isilon, PowerScale OneFS Provide Feedback Users can evaluate the accuracy, usefulness, and ease of understanding of the article and provide additional information.

Goal Reached Thanks to every supporter — we hit 100%!

Dell PowerScale OneFS Security Advisory: CVE-2026-49501 LPE and CVE-2026-40633 Info Disclosure

More from this source