CVE-2026-22281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22281", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-07T07:17:24.536Z", "datePublished": "2026-01-22T19:11:28.454Z", "dateUpdated": "2026-01-22T19:35:02.793Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PowerScale OneFS", "vendor": "Dell", "versions": [{"lessThan": "9.13.0.0", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.5.1.6", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.7.1.11", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.10.1.4", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2026-01-22T18:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service.<br>"}], "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-22T19:11:28.454Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000415586/dsa-2026-049-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T19:34:56.397416Z", "id": "CVE-2026-22281", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T19:35:02.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T19:34:56.397416Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T19:34:59.694Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "PowerScale OneFS", "versions": [{"status": "affected", "version": "N/A", "lessThan": "9.13.0.0", "versionType": "semver"}, {"status": "affected", "version": "N/A", "lessThan": "9.5.1.6", "versionType": "semver"}, {"status": "affected", "version": "N/A", "lessThan": "9.7.1.11", "versionType": "semver"}, {"status": "affected", "version": "N/A", "lessThan": "9.10.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-22T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000415586/dsa-2026-049-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-22T19:11:28.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22281", "state": "PUBLISHED", "dateUpdated": "2026-01-22T19:35:02.793Z", "dateReserved": "2026-01-07T07:17:24.536Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-01-22T19:11:28.454Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerScale OneFS", "vendor": "Dell", "versions": [{"lessThan": "9.13.0.0", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.5.1.6", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.7.1.11", "status": "affected", "version": "N/A", "versionType": "semver"}, {"lessThan": "9.10.1.4", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "75F87F94-D52B-4D81-89A7-CBE5AEFEBA5A", "versionEndExcluding": "9.5.1.6", "versionStartIncluding": "9.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E921D4F-223E-4630-897F-B55D2B1E06A7", "versionEndExcluding": "9.7.1.11", "versionStartIncluding": "9.6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "80A6C071-87C3-40C6-8C26-F6D239A77388", "versionEndExcluding": "9.10.1.4", "versionStartIncluding": "9.8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "9019F2DB-1449-4315-85CB-A35BB2AEF4BB", "versionEndExcluding": "9.13.0.0", "versionStartIncluding": "9.11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service."}, {"lang": "es", "value": "Dell PowerScale OneFS, versiones 9.5.0.0 a 9.5.1.5, versiones 9.6.0.0 a 9.7.1.10, versiones 9.8.0.0 a 9.10.1.3, versiones a partir de 9.11.0.0 y anteriores a 9.13.0.0, contiene una vulnerabilidad de condici\u00f3n de carrera de tipo Time-of-check Time-of-use (TOCTOU). Un atacante con privilegios bajos con acceso a la red adyacente podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a una denegaci\u00f3n de servicio."}], "id": "CVE-2026-22281", "lastModified": "2026-06-17T10:19:41.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22281", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T19:34:56.397416Z", "version": "2.0.3"}}]}, "published": "2026-01-22T20:16:13.257", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000415586/dsa-2026-049-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:24:04.549576+00:00", "value": {"mitigation_remediation": ["Download and install the latest security update for Dell PowerScale OneFS from Dell\u2019s official support portal", "Restrict adjacent network access to the PowerScale cluster and enforce least privilege for accounts that can interact with the file system", "Monitor cluster logs for unexpected service restarts or performance degradation and adjust monitoring thresholds accordingly"], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Dell PowerScale OneFS products with versions 9.5.0.0 through 9.5.1.5, 9.6.0.0 through 9.7.1.10, 9.8.0.0 through 9.10.1.3, and 9.11.0.0 up to but not including 9.13.0.0 are vulnerable.", "description_and_impact": "The vulnerability describes a Time\u2011of\u2011check Time\u2011of\u2011use race condition that allows a low\u2011privileged attacker with adjacent network access to cause service interruption on Dell PowerScale OneFS. The race condition does not provide direct access to data or application logic; it can result in a denial of service for clients using affected file system operations.", "risk_and_exploitability": "The CVSS score of 3.5 indicates low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is a low\u2011privileged user who can interact with the network segment that hosts the storage cluster; the race condition may be triggered by concurrent operations on the file system, potentially causing service disruption."}}}}, "created": "2026-01-23T10:27:30.516946+00:00", "title": "Denial of Service via Time\u2011of\u2011Check Time\u2011of\u2011Use Race Condition in Dell PowerScale OneFS", "updated": "2026-04-18T15:30:03.958396+00:00", "vendors": ["dell", "dell$PRODUCT$powerscale_onefs"]}