Unauthenticated Dell CSM flaw leaks admin credentials for every registered storage array

On exploitability, CVE-2026-63688 is the worst flaw in the release. It needs no account and works remotely ^[4]. The attacker gets the backend administrator credentials for every storage array registered with the Authorization module, plus full administrative control of the storage infrastructure ^[4]. Dell's Thursday advisory traces this flaw and CVE-2026-63692 to the same weakness: missing authentication for critical functions ^[3].

Registration sets the scope. CSM fronts Dell's PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT arrays and extends the standard Kubernetes CSI drivers ^[7]. A shop that registered arrays from several of those product lines with one Authorization deployment has put all of them behind the same unauthenticated function ^[4]. Dell described the tenant-service bug in multi-tenant terms. "This vulnerability is considered critical as it enables an unauthenticated attacker to gain complete administrative control over the authorization service, potentially allowing unauthorized access to and manipulation of storage resources across all tenants," the company said ^[10].

Including the companion bugs, the release fixes six critical flaws. The report describes every one as exploitable without prior credentials or privileges ^[15]. At least three of the six end in administrative control of the Authorization service, its proxy, or the storage behind it ^[14].

The report does not say whether exploit code is public, what network position an attacker needs, or whether any mitigation short of the upgrade exists. Reachability therefore sets each deployment's deadline. An Authorization proxy that answers from outside the cluster offers the full credential scope of CVE-2026-63688 to anyone on that network ^[4].

Dell's exploitation history comes from other products ^[5][6]. North Korea's Lazarus group used an insufficient-access-control bug in Dell's dbutil driver, CVE-2021-21551, to plant a Windows rootkit ^[5]. In February, Mandiant and the Google Threat Intelligence Group reported that UNC6201, a suspected Chinese state-backed group, had exploited a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines, CVE-2026-22769, since at least mid-2024 ^[6]. The group used it to deploy malware and create hidden network interfaces on VMware ESXi servers ^[6]. The researchers found overlaps between UNC6201 and Silk Typhoon ^[8]. Days later, CISA ordered federal agencies to patch vulnerable Dell systems within three days ^[13].