DSA-2026-172: Security Update for Dell PowerScale OneFS Multiple Vulnerabilities

Résumé: Dell PowerScale OneFS remediation is available for insufficient logging vulnerability that could be exploited by malicious users to compromise the affected system.

Cet article concerne Cet article ne concerne pas Cet article n’est associé à aucun produit spécifique. Toutes les versions du produit ne sont pas identifiées dans cet article.
Consulter d’autres ressources

Impact

Medium

Détails

Third-party Component CVEs More Information
OpenSSL CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 
libexpat CVE-2026-25210
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 
OpenSSH CVE-2025-61984, CVE-2025-61985
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40640

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6, versions 9.11.0.0 through 9.13.0.2 contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40634

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0, contains an Improper Control of Resource Identifiers ('Resource Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies. 
Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40640

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6, versions 9.11.0.0 through 9.13.0.2 contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40634

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0, contains an Improper Control of Resource Identifiers ('Resource Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies. 
Dell Technologies recommande à tous les clients de prendre en compte à la fois le score de base CVSS et les scores temporels et environnementaux pertinents qui peuvent avoir un impact sur la gravité potentielle associée à une faille de sécurité donnée.

Produits concernés et mesure corrective

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-32803 PowerScale Onefs Versions 9.5.0.0 through 9.5.1.6 Version 9.5.1.7 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.6.0.0 through 9.7.1.13 Version 9.7.1.14 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.8.0.0 through 9.10.1.5 Version 9.10.1.6 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.11.0.0 through 9.12.0.1 Version 9.13.0.0 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.5.0.0 through 9.10.1.6 Version 9.10.1.7 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.11.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVE-2025-61984, CVE-2025-61985 PowerScale Onefs Versions 9.5.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-32803 PowerScale Onefs Versions 9.5.0.0 through 9.5.1.6 Version 9.5.1.7 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.6.0.0 through 9.7.1.13 Version 9.7.1.14 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.8.0.0 through 9.10.1.5 Version 9.10.1.6 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.11.0.0 through 9.12.0.1 Version 9.13.0.0 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.5.0.0 through 9.10.1.6 Version 9.10.1.7 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.11.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVE-2025-61984, CVE-2025-61985 PowerScale Onefs Versions 9.5.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area

We encourage all customers to adopt the Long-Term Support (LTS) 2025 version which is 9.10.1.x code line, with the latest maintenance release.

For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary and Security Update Release Schedule for Supported Versions of Dell PowerScale OneFS.

Solutions de contournement et mesures d’atténuation

CVE ID Workaround and Mitigation
CVE-2026-40634 To mitigate this vulnerability, the security recommendation is to use a dedicated logging target bucket and do not grant general users write access to that bucket. This prevents a user from creating conflicting objects in the log destination and preserves logging integrity.Operational guidance:Dedicated target logging bucket: Configure a specific, dedicated logging bucket as the logging target bucket (separate from source buckets).ACL / permissions: Do NOT grant WRITE access on the logging bucket to non-admin or non-source-bucket-owners.Integrity / immutability: If immutable retention is required, enable S3 Lock on the dedicated logging bucket (and use appropriate retention governance/compliance settings per your deployment policy).With the above configuration, malicious users cannot pre-create objects in the LogKey path (including using the source bucket name) to block LogCache log dump, and cannot manually insert custom data into the logging destination.

Historique des révisions

RevisionDateDescription
1.02026-05-05Initial Release
2.02026-05-25Revised DSA to include CVEs CVE-2026-40640, CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40634, CVE-2026-25210,CVE-2025-61984, CVE-2025-61985

Informations connexes

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Mention légale

Produits concernés

PowerScale OneFS
Propriétés de l’article
Numéro d’article: 000461228
Type d’article: Dell Security Advisory
Dernière modification: 25 May 2026
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.