CVE-2026-54489: Infoleak
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session credentials and fully impersonate authenticated users, including administrators. Dell recommends customers to upgrade at the earliest opportunity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dell Virtual Storage Integrator for VMware vSphere Clientto a version that resolves this vulnerability.Fixed in 10.11.1.0 - Compensating control
Because the flaw can allow unauthenticated session hijacking and impersonation, restrict network access to the affected Virtual Storage Integrator service/endpoint so it is reachable only from trusted networks or via controlled management access while upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54489?
The severity of CVE-2026-54489 is rated as critical with a CVSS score of 9.1.
How do I fix CVE-2026-54489?
To fix CVE-2026-54489, update Dell Virtual Storage Integrator for VMware vSphere Client to version 10.11.1.0 or later.
What kind of vulnerability is CVE-2026-54489?
CVE-2026-54489 is a Sensitive Information Disclosure vulnerability.
What could an attacker achieve by exploiting CVE-2026-54489?
An unauthenticated remote attacker could exploit CVE-2026-54489 to disclose sensitive information and potentially hijack sessions.
Which versions of Dell Virtual Storage Integrator are affected by CVE-2026-54489?
Versions of Dell Virtual Storage Integrator for VMware vSphere Client prior to 10.11.1.0 are affected by CVE-2026-54489.