Incorrect permission assignment in Dell PowerScale OneFS
Priority LOW 25CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploit this vulnerability resulting in the ability to write data outside of the intended file system location.
Why it matters now
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed PowerScale OneFS (Dell): 8.1.2, 8.2.1, 8.2.2 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | PowerScale OneFS | before 8.1.2, 8.2.1, 8.2.2, 9.0.0 | 8.1.2, 8.2.1, 8.2.2, 9.0.0 | Patch available | CNA |
- PowerScale OneFS VendorDell Affected before 8.1.2, 8.2.1, 8.2.2, 9.0.0 Fixed in 8.1.2, 8.2.1, 8.2.2, 9.0.0 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_powerscale_onefs:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:8.1.1:*:*:*:*:*:*:* | 8.1.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:8.1.2:*:*:*:*:*:*:* | 8.1.2 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:8.2.0:*:*:*:*:*:*:* | 8.2.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:8.2.1:*:*:*:*:*:*:* | 8.2.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:8.2.2:*:*:*:*:*:*:* | 8.2.2 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_powerscale_onefs:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | Dell |
- cpe:2.3:o:dell:emc_powerscale_onefs:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:8.1.2:*:*:*:*:*:*:* Versions 8.1.2 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_powerscale_onefs:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Dell
Remediation
- Fix · CNA PowerScale OneFS (Dell) Fixed in 8.1.2, 8.2.1, 8.2.2, 9.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26196
- 2026-10-03 Alias added: GHSA-5c78-cfx6-pmjr
References
More Dell Emc Powerscale Onefs vulnerabilities
- TI-2022-22190 Improper privilege management in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-10097 Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random… CVSS 3.1CRITICAL 9.8
- TI-2022-06835 Missing brute-force protection in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2021-04595 Improper authentication in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-22189 Improper certificate validation in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-15270 Insufficiently protected credentials in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-26196 · CVE Program
- CVE-2020-26196 · NVD
- FIRST EPSS
- GHSA-5c78-cfx6-pmjr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences