PT-2026-57155 · Dell · Powerflex Manager

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56688

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerFlex Manager versions prior to 5.1.0.1

Description An OS Command Injection flaw exists in the OS Repository processing component due to improper neutralization of special elements used in OS commands. A high-privileged attacker with remote access can exploit this by providing crafted parameters or repository content, allowing attacker-controlled input to reach system command execution paths. This can result in arbitrary command execution as root, potentially leading to full appliance compromise and lateral movement into managed infrastructure.

Recommendations Upgrade to version 5.1.0.1.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-56688

Affected Products

Powerflex Manager

References · 5

• https://dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56688 · Security Note
• https://twitter.com/UpwindMDR/status/2075583353424605487 · Twitter Post
• https://twitter.com/SecPoBr/status/2075674850815795543 · Twitter Post
• https://twitter.com/vuldb/status/2075559222251786696 · Twitter Post