CVE-2026-63688

Published Oct 6, 2026

Last updated 10 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-63688 is an authentication vulnerability found in Dell Container Storage Modules (CSM), specifically affecting the `csm-authorization-storage` gRPC server. The flaw allows a remote attacker to obtain unauthorized access to storage backend administrator credentials for all registered storage arrays. This access can grant administrative control over the storage infrastructure across all five supported Dell storage product families. The vulnerability is addressed in Dell's security advisory DSA-2026-448, and the vendor recommends upgrading to version 1.18.0 to mitigate the issue. At the time of disclosure, there were no reports of active exploitation in the wild or public proof-of-concept exploits.

Description: Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.
Source: security_alert@emc.com
NVD status: Analyzed
Products: container_storage_modules

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security_alert@emc.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8928435D-6205-42ED-A551-DCF4AEF943A8",
            "versionEndExcluding": "1.18.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.