CVE-2026-24511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24511", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-23T06:07:21.818Z", "datePublished": "2026-04-08T12:28:21.077Z", "dateUpdated": "2026-04-08T16:13:35.249Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-04-08T12:28:21.077Z"}, "datePublic": "2026-04-05T18:30:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}], "affected": [{"vendor": "Dell", "product": "PowerScale OneFS", "versions": [{"status": "affected", "version": "0", "lessThan": "9.10.1.7 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and\u00a0versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A\u00a0high privileged attacker with local access\u00a0could potentially exploit this vulnerability, leading to information disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure."}]}], "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:43:07.952309Z", "id": "CVE-2026-24511", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:13:35.249Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24511", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:43:07.952309Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:43:14.751Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "PowerScale OneFS", "versions": [{"status": "affected", "version": "0", "lessThan": "9.10.1.7 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-05T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and\u00a0versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A\u00a0high privileged attacker with local access\u00a0could potentially exploit this vulnerability, leading to information disclosure.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-04-08T12:28:21.077Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24511", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:13:35.249Z", "dateReserved": "2026-01-23T06:07:21.818Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-04-08T12:28:21.077Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerScale OneFS", "vendor": "Dell", "versions": [{"lessThan": "9.10.1.7 or later", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FC6B685-F7C8-4A13-8AFE-7C4C1D7D9B10", "versionEndExcluding": "9.10.1.7", "versionStartIncluding": "9.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:powerscale_onefs:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FF0D943-411F-4CC7-8730-966894CD853E", "versionEndExcluding": "9.13.0.1", "versionStartIncluding": "9.11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and\u00a0versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A\u00a0high privileged attacker with local access\u00a0could potentially exploit this vulnerability, leading to information disclosure."}, {"lang": "es", "value": "Dell PowerScale OneFS, versiones 9.5.0.0 hasta 9.10.1.6 y versiones 9.11.0.0 hasta 9.13.0.0, contiene una vulnerabilidad de generaci\u00f3n de mensajes de error que contienen informaci\u00f3n sensible. Un atacante con altos privilegios y acceso local podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-24511", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24511", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:43:07.952309Z", "version": "2.0.3"}}]}, "published": "2026-04-08T13:16:40.367", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.10.1.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerScale OneFS", "source": "cna", "vendor": "Dell"}, "product": "powerscale_onefs", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-13T12:21:30.470002+00:00", "value": {"mitigation_remediation": ["Apply Dell PowerScale OneFS update DSA\u20112026\u2011125, which addresses the error\u2011message data exposure.", "Verify that the updated system no longer includes sensitive information in error messages after the patch is applied.", "Limit local privileged access to trusted administrators only to reduce the risk of exploitation.", "Monitor system logs for unexpected or sensitive error output as an additional detection measure.", "If a patch cannot be applied immediately, consider disabling verbose error logging or other configuration options that may reduce data visibility."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected products are Dell PowerScale OneFS. Versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0 are impacted. No other vendors or products are mentioned.", "description_and_impact": "Dell PowerScale OneFS may expose sensitive data in error messages. The flaw allows a high\u2011privileged local attacker to view confidential information that should not appear in error logs. This is a classic data\u2011exposure weakness identified as CWE\u2011209. The vulnerability results in the unnecessary leakage of potentially critical system details to local users with sufficient privileges, compromising confidentiality but not allowing system compromise or remote control.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, high\u2011privilege access, so the attack vector is inferred to be local. A privileged user can trigger or read error messages that contain sensitive data, potentially revealing configuration or credential information."}}}}, "created": "2026-04-08T19:27:06.588193+00:00", "updated": "2026-04-13T14:25:09.461861+00:00", "vendors": ["dell", "dell$PRODUCT$powerscale_onefs"]}