DSA-2026-172: Security Update for Dell PowerScale OneFS Multiple Vulnerabilities

概要: Dell PowerScale OneFS remediation is available for insufficient logging vulnerability that could be exploited by malicious users to compromise the affected system.

この記事は次に適用されます： この記事は次には適用されません： この記事は、特定の製品に関連付けられていません。 すべての製品パージョンがこの記事に記載されているわけではありません。
他のリソースを確認する

影響

Medium

詳細

Third-party Component CVEs More Information
OpenSSL CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 
libexpat CVE-2026-25210
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 
OpenSSH CVE-2025-61984, CVE-2025-61985
https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies. 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40640

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6, versions 9.11.0.0 through 9.13.0.2 contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40634

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0, contains an Improper Control of Resource Identifiers ('Resource Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies. 
Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40640

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6, versions 9.11.0.0 through 9.13.0.2 contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies. 
CVE-2026-40634

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0, contains an Improper Control of Resource Identifiers ('Resource Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies. 
デル・テクノロジーズでは、すべてのお客様に対して、CVSSベース スコアに加えて、特定のセキュリティの脆弱性に付随する潜在的な重要度に影響する可能性のある現状スコアや環境スコアも考慮することをお勧めしています。

影響を受ける製品と修復

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-32803 PowerScale Onefs Versions 9.5.0.0 through 9.5.1.6 Version 9.5.1.7 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.6.0.0 through 9.7.1.13 Version 9.7.1.14 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.8.0.0 through 9.10.1.5 Version 9.10.1.6 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.11.0.0 through 9.12.0.1 Version 9.13.0.0 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.5.0.0 through 9.10.1.6 Version 9.10.1.7 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.11.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVE-2025-61984, CVE-2025-61985 PowerScale Onefs Versions 9.5.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-32803 PowerScale Onefs Versions 9.5.0.0 through 9.5.1.6 Version 9.5.1.7 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.6.0.0 through 9.7.1.13 Version 9.7.1.14 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.8.0.0 through 9.10.1.5 Version 9.10.1.6 or later PowerScale OneFS Downloads Area
CVE-2026-32803 PowerScale Onefs Versions 9.11.0.0 through 9.12.0.1 Version 9.13.0.0 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.5.0.0 through 9.10.1.6 Version 9.10.1.7 or later PowerScale OneFS Downloads Area
CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40640, CVE-2026-25210 PowerScale Onefs Versions 9.11.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area
CVE-2025-61984, CVE-2025-61985 PowerScale Onefs Versions 9.5.0.0 through 9.13.0.2 Version 9.13.1.0 or later PowerScale OneFS Downloads Area

We encourage all customers to adopt the Long-Term Support (LTS) 2025 version which is 9.10.1.x code line, with the latest maintenance release.

For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary and Security Update Release Schedule for Supported Versions of Dell PowerScale OneFS.

回避策と緩和策

CVE ID Workaround and Mitigation
CVE-2026-40634 To mitigate this vulnerability, the security recommendation is to use a dedicated logging target bucket and do not grant general users write access to that bucket. This prevents a user from creating conflicting objects in the log destination and preserves logging integrity.Operational guidance:Dedicated target logging bucket: Configure a specific, dedicated logging bucket as the logging target bucket (separate from source buckets).ACL / permissions: Do NOT grant WRITE access on the logging bucket to non-admin or non-source-bucket-owners.Integrity / immutability: If immutable retention is required, enable S3 Lock on the dedicated logging bucket (and use appropriate retention governance/compliance settings per your deployment policy).With the above configuration, malicious users cannot pre-create objects in the LogKey path (including using the source bucket name) to block LogCache log dump, and cannot manually insert custom data into the logging destination.

変更履歴

RevisionDateDescription
1.02026-05-05Initial Release
2.02026-05-25Revised DSA to include CVEs CVE-2026-40640, CVE-2025-15467, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796, CVE-2026-40634, CVE-2026-25210,CVE-2025-61984, CVE-2025-61985

関連情報

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

法的免責事項

対象製品

PowerScale OneFS
文書のプロパティ
文書番号: 000461228
文書の種類: Dell Security Advisory
最終更新: 25 5月 2026
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。