Dell patches 44 PowerStore flaws, including seven rated 9.8

Dell has issued security advisory DSA-2026-479 for 44 vulnerabilities affecting 13 PowerStore models. The flaws affect all PowerStoreT OS 5.1.x versions earlier than 5.1.0.0-2798105. Dell has released PowerStoreT OS 5.1.0[.]0-2798105 to address them; the advisory lists 11 vulnerabilities with CVSS v3.1 scores of 9.0 or higher, including seven rated 9.8. Dell has not reported exploitation.

Most of the critical issues affect the SDNAS file-services layer. CVE-2026-116443 is a stack-based buffer overflow in the NAS TFTP service that could let an unauthenticated remote attacker cause a denial of service or potentially execute code. CVE-2026-116448 and CVE-2026-116449 are command injection flaws that could give attackers with internal network access root command access on the NAS node.

CVE-2026-116439 is a path traversal flaw that could allow unauthenticated attackers to read, modify or delete arbitrary files. Other issues include an out-of-bounds write that could enable code execution with system privileges, and weaknesses that could expose stored private keys or allow attackers to take control of backup and restore operations.

Affected systems include PowerStore 500T, 1000T, 1200T, 3000T, 3200T, 5000T, 5200T, 7000T, 9000T, 9200T, 1500, 5500 and 9500 models. Dell recommends updating to PowerStoreT OS 5.1.0[.]0-2798105 or later. Until then, the advisory recommends limiting access to NAS services such as TFTP and NFS, and restricting management interfaces to trusted administrator networks.