CVE-2026-68862: OS Command Injection
Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Organizations using the Dell Terraform Provider for Dell PowerFlex to provision SDC hosts are exposed if an attacker has high-privilege access to the PowerFlex management plane. The potential impact is on provisioned SDC hosts, which could be fully compromised.
What access does an attacker need to exploit it?
An attacker must be remote and already hold high privileges with access to the PowerFlex management plane. Exploitation does not require user interaction, but has high attack complexity.
What is the likely impact of successful exploitation?
Successful exploitation can execute arbitrary operating-system commands on provisioned SDC hosts. This may result in full compromise affecting confidentiality, integrity, and availability of those hosts.