CVE-2026-22270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22270", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-07T06:43:46.537Z", "datePublished": "2026-03-04T12:22:18.277Z", "dateUpdated": "2026-03-05T04:55:36.427Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PowerScale OneFS,", "vendor": "Dell", "versions": [{"lessThan": "9.13.0.0 or later", "status": "affected", "version": "9.11.0.0 through 9.12.0.1", "versionType": "semver"}, {"lessThan": "9.10.1.6 or later", "status": "affected", "version": "prior to 9.10.1.6", "versionType": "semver"}]}], "datePublic": "2026-02-24T18:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.<br>"}], "value": "Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-04T12:34:10.420Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-sg/000432452/dsa-2026-038-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-22270"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T04:55:36.427Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T15:15:58.303641Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T15:27:13.213Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "PowerScale OneFS,", "versions": [{"status": "affected", "version": "9.11.0.0 through 9.12.0.1", "lessThan": "9.13.0.0 or later", "versionType": "semver"}, {"status": "affected", "version": "prior to 9.10.1.6", "lessThan": "9.10.1.6 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-24T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-sg/000432452/dsa-2026-038-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-04T12:34:10.420Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22270", "state": "PUBLISHED", "dateUpdated": "2026-03-05T04:55:36.427Z", "dateReserved": "2026-01-07T06:43:46.537Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-03-04T12:22:18.277Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerScale OneFS,", "vendor": "Dell", "versions": [{"lessThan": "9.13.0.0 or later", "status": "affected", "version": "9.11.0.0 through 9.12.0.1", "versionType": "semver"}, {"lessThan": "9.10.1.6 or later", "status": "affected", "version": "prior to 9.10.1.6", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "C542DE7A-D4BD-4127-A14F-6A1D151A40F6", "versionEndExcluding": "9.10.1.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "23042111-E6E9-4C6B-8A89-2E7E3F44103F", "versionEndExcluding": "9.13.0.0", "versionStartIncluding": "9.11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure."}, {"lang": "es", "value": "Dell PowerScale OneFS, versiones anteriores a 9.10.1.6 y versiones desde 9.11.0.0 hasta 9.12.0.1, contiene una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada. Un atacante con altos privilegios y acceso local podr\u00eda potencialmente explotar esta vulnerabilidad, lo que podr\u00eda llevar a una denegaci\u00f3n de servicio, elevaci\u00f3n de privilegios y revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-22270", "lastModified": "2026-06-17T10:19:40.320", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22270", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-04T13:15:57.967", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-sg/000432452/dsa-2026-038-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.11.0.0,9.12.0.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.10.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerScale OneFS,", "source": "cna", "vendor": "Dell"}, "product": "powerscale_onefs", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-17T13:11:54.616372+00:00", "value": {"mitigation_remediation": ["Apply Dell\u2019s DSA\u20112026\u2011038 security update to upgrade OneFS to 9.10.1.6 or a newer release such as 9.12.0.2 that removes the unsupported search path element.", "If an immediate upgrade is not feasible, enforce the principle of least privilege by restricting local administrator accounts, disabling unnecessary executable paths, and monitoring for anomalous process activity related to path traversal.", "Audit and cleanse the system PATH configuration on all affected nodes to ensure no unauthorized or unsupported directories are included, preventing unintended search path usage."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation, Denial of Service, Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is Dell PowerScale OneFS. Versions prior to 9.10.1.6 and those ranging from 9.11.0.0 through 9.12.0.1 are vulnerable. Installing any release equal to or greater than 9.10.1.6 or 9.12.0.2 resolves the issue.", "description_and_impact": "Dell PowerScale OneFS suffers from an uncontrolled search path element flaw that permits a local user with high privileges to execute arbitrary commands during system operations. This vulnerability can cause denial of service, elevate a user\u2019s effective privileges beyond their intended scope, and expose sensitive system information. The weakness is categorized as CWE\u2011427, which describes the unauthorized use of an environmental variable to influence program execution.", "risk_and_exploitability": "The CVSS score of 6.7 indicates a moderate-to-high risk, while the EPSS probability is below 1%, suggesting low likelihood of active exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog, but the combination of local privileged access and uncontrolled path traversal still warrants prompt attention, as it could be leveraged by an insider or compromised service account. The attack vector involves local system access with elevated rights; no remote exploitation pathways are documented."}}}}, "created": "2026-03-04T21:03:37.405522+00:00", "title": "Uncontrolled Search Path Element in Dell PowerScale OneFS Enables Local Privilege Escalation and Denial of Service", "updated": "2026-04-17T13:15:19.687273+00:00", "vendors": ["dell", "dell$PRODUCT$powerscale_onefs"]}