DSA-2026-360: Security Update for Dell PowerScale OneFS Multiple Vulnerabilities

요약: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
기타 리소스 확인

영향

High

세부 정보

Third-party Component CVEs More information
FreeBSD ip6_multicast CVE-2026-49412 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD CVE-2026-4747 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD exec CVE-2026-7270 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD libnv CVE-2026-39457 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD dhclient CVE-2026-42512 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
OpenSSH CVE-2026-35414 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD file CVE-2026-45251 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD libcasper CVE-2026-39461 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD capsicum CVE-2026-45259 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
FreeBSD th CVE-2026-45256 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
pyca/cryptography CVE-2026-34073 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
Python CVE-2026-3446 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
Apache HTTP Server CVE-2026-24072 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
OpenSSH CVE-2026-35386, CVE-2026-35387, CVE-2026-35388 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.
OpenSSL CVE-2026-34180, CVE-2026-34181 https://nvd.nist.gov/search This hyperlink is taking you to a website outside of Dell Technologies.

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-70425 Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability. 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H  This hyperlink is taking you to a website outside of Dell Technologies.
CVE-2026-40635 Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering. 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies.
CVE-2026-46460 Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs. 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N This hyperlink is taking you to a website outside of Dell Technologies.
Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2026-70425 Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability. 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H  This hyperlink is taking you to a website outside of Dell Technologies.
CVE-2026-40635 Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering. 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L This hyperlink is taking you to a website outside of Dell Technologies.
CVE-2026-46460 Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs. 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N This hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies는 모든 고객이 CVSS 기본 점수와 관련 임시 및 환경 점수를 모두 고려할 것을 권장합니다. 이 경우 특정 보안 취약성과 관련된 잠재적인 심각도에 영향을 미칠 수 있습니다.

영향을 받는 제품 및 문제 해결

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-35414, CVE-2026-46460 PowerScale OneFS Versions 9.5.0.0 through 9.7.1.15 Version 9.7.1.16 or later PowerScale OneFS Downloads Area
CVE-2026-4747 PowerScale OneFS Versions 9.5.0.0 through 9.10.1.7 Version 9.10.1.8 or later PowerScale OneFS Downloads Area
CVE-2026-35414 PowerScale OneFS Versions 9.8.0.0 through 9.10.1.7 Version 9.10.1.8 or later PowerScale OneFS Downloads Area
CVE-2026-4747, CVE-2026-35414 PowerScale OneFS Versions 9.11.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-3446, CVE-2026-7270, CVE-2026-24072, CVE-2026-34073, CVE-2026-34180, CVE-2026-34181, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-39457, CVE-2026-39461, CVE-2026-40635, CVE-2026-42512, CVE-2026-45251, CVE-2026-45256, CVE-2026-45259, CVE-2026-49412 PowerScale OneFS Versions 9.5.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-46460 PowerScale OneFS Versions 9.8.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-70425 PowerScale OneFS Versions 9.5.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-3446, CVE-2026-4747 PowerScale OneFS Version 9.14.0.0 Version 9.14.0.1 or later PowerScale OneFS Downloads Area
CVE-2026-7270, CVE-2026-24072, CVE-2026-34073, CVE-2026-34180, CVE-2026-34181, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-39457, CVE-2026-39461, CVE-2026-40635, CVE-2026-42512, CVE-2026-45251, CVE-2026-45256, CVE-2026-45259, CVE-2026-46460, CVE-2026-49412 PowerScale OneFS Versions 9.14.0.0 through 9.14.0.1 Version 9.15.0.0 or later PowerScale OneFS Downloads Area
CVE-2026-70425 PowerScale OneFS Versions 9.14.0.0 through 9.14.0.1 Version 9.15.0.0 or later PowerScale OneFS Downloads Area

 

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2026-35414, CVE-2026-46460 PowerScale OneFS Versions 9.5.0.0 through 9.7.1.15 Version 9.7.1.16 or later PowerScale OneFS Downloads Area
CVE-2026-4747 PowerScale OneFS Versions 9.5.0.0 through 9.10.1.7 Version 9.10.1.8 or later PowerScale OneFS Downloads Area
CVE-2026-35414 PowerScale OneFS Versions 9.8.0.0 through 9.10.1.7 Version 9.10.1.8 or later PowerScale OneFS Downloads Area
CVE-2026-4747, CVE-2026-35414 PowerScale OneFS Versions 9.11.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-3446, CVE-2026-7270, CVE-2026-24072, CVE-2026-34073, CVE-2026-34180, CVE-2026-34181, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-39457, CVE-2026-39461, CVE-2026-40635, CVE-2026-42512, CVE-2026-45251, CVE-2026-45256, CVE-2026-45259, CVE-2026-49412 PowerScale OneFS Versions 9.5.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-46460 PowerScale OneFS Versions 9.8.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-70425 PowerScale OneFS Versions 9.5.0.0 through 9.13.1.0 Version 9.13.1.1 or later PowerScale OneFS Downloads Area
CVE-2026-3446, CVE-2026-4747 PowerScale OneFS Version 9.14.0.0 Version 9.14.0.1 or later PowerScale OneFS Downloads Area
CVE-2026-7270, CVE-2026-24072, CVE-2026-34073, CVE-2026-34180, CVE-2026-34181, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-39457, CVE-2026-39461, CVE-2026-40635, CVE-2026-42512, CVE-2026-45251, CVE-2026-45256, CVE-2026-45259, CVE-2026-46460, CVE-2026-49412 PowerScale OneFS Versions 9.14.0.0 through 9.14.0.1 Version 9.15.0.0 or later PowerScale OneFS Downloads Area
CVE-2026-70425 PowerScale OneFS Versions 9.14.0.0 through 9.14.0.1 Version 9.15.0.0 or later PowerScale OneFS Downloads Area

 

We encourage all customers to adopt the Long-Term Support (LTS) 2026 version which is the 9.13.1 code line, with the latest 9.13.1.x maintenance release.

For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary and Security Update Release Schedule for Supported Versions of Dell PowerScale OneFS.

개정 내역

RevisionDateDescription
1.02026-09-03Initial Release
2.02026-09-03Adding Acknowledgements

감사의 말

CVE-2026-70425: Dell would like to thank WinD39 - Huynh Dinh Vu for reporting this issue. 

관련 정보

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

법적 고지 사항

해당 제품

Isilon, PowerScale OneFS
문서 속성
문서 번호: 000505684
문서 유형: Dell Security Advisory
마지막 수정 시간: 03 9월 2026
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.