Dell PowerScale OneFS up to 9.13.0.0 permission assignment

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Dell PowerScale OneFS up to 9.13.0.0. This impacts an unknown function. Performing a manipulation results in permission assignment. This vulnerability was named CVE-2026-22280. The attack needs to be approached locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Dell PowerScale OneFS up to 9.13.0.0. It has been classified as problematic. This affects an unknown functionality. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on availability. The summary by CVE is:

Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains an incorrect permission assignment for critical resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

It is possible to read the advisory at dell.com. This vulnerability is uniquely identified as CVE-2026-22280 since 01/07/2026. The exploitability is told to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 9.5.1.6, 9.7.1.11, 9.10.1.4 or 9.13.0.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3785). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Dell

Name

• PowerScale OneFS

Version

• 9.5.0
• 9.5.1.0
• 9.5.1.1
• 9.5.1.2
• 9.5.1.3
• 9.5.1.4
• 9.5.1.5
• 9.6.0
• 9.7.1.0
• 9.7.1.1
• 9.7.1.2
• 9.7.1.3
• 9.7.1.4
• 9.7.1.5
• 9.7.1.6
• 9.7.1.7
• 9.7.1.8
• 9.7.1.9
• 9.7.1.10
• 9.8.0
• 9.10.1.0
• 9.10.1.1
• 9.10.1.2
• 9.10.1.3
• 9.11.0
• 9.13.0

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion