CVE-2026-68862

MEDIUM 6.6

CVSS Score

6.6

EPSS Score

0.0%

EPSS Percentile

0th

Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.

CWE	CWE-78
Vendor	dell
Product	terraform provider for dell powerflex
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for dell terraform provider for dell powerflex

Be the first to know when new medium vulnerabilities affecting dell terraform provider for dell powerflex are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Dell / Terraform Provider for Dell PowerFlex

0 < 1.9.0 or later

References

NVD ↗ CVE.org ↗ EPSS Data ↗

dell.com: https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities

Credits

🔍 Dell would like to thank Rudra_16 for reporting this issue.