CVE-2026-24511: Information Disclosure in Dell PowerScale OneFS

Successful exploitation of CVE-2026-24511 could lead to the exposure of sensitive data stored or processed by the Dell PowerScale OneFS system. While the vulnerability requires local access and high privileges, a compromised administrator account or a local attacker gaining access to the system could leverage this flaw. The specific information disclosed depends on the error messages generated, but could include configuration details, user credentials, or potentially even data stored within the OneFS environment. This could facilitate further attacks, such as privilege escalation or data exfiltration.

1. Reserved2026-01-23
2. Published2026-04-08
3. EPSS updated2026-04-16

The primary mitigation for CVE-2026-24511 is to upgrade Dell PowerScale OneFS to version 9.10.1.7 or later. If an immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with high privileges on the system. Monitor system logs for unusual error messages or patterns that might indicate exploitation attempts. While a WAF is unlikely to directly mitigate this vulnerability, reviewing and hardening OneFS configuration can reduce the attack surface. After upgrading, verify the fix by attempting to trigger the vulnerable error message and confirming that sensitive information is no longer disclosed.