TI-2026-21304 Aliases CVE-2026-26357 GHSA-3q38-qghq-9hmp

Cross-site scripting in Dell Unisphere for PowerMax 9.2.4.18

LOW 24CWE-79Published 2026-02-17 · Updated 2026-03-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0019 8th percentileScored 2026-11-07

Fix Fixed Unisphere for PowerMax 9.2.4.18 (Dell): 9.2.4.19Unisphere for PowerMax Virtual Appliance 9.2.4.17 (Dell): 9.2.4.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Unisphere for PowerMax 9.2.4.18	N/A to before 9.2.4.19	9.2.4.19	Patch available	CNA
Dell	Unisphere for PowerMax Virtual Appliance 9.2.4.17	N/A to before 9.2.4.19	9.2.4.19	Patch available	CNA

Unisphere for PowerMax 9.2.4.18 VendorDell Affected N/A to before 9.2.4.19 Fixed in 9.2.4.19 Patch available CNA
Unisphere for PowerMax Virtual Appliance 9.2.4.17 VendorDell Affected N/A to before 9.2.4.19 Fixed in 9.2.4.19 Patch available CNA

Remediation

Fix · CNA Unisphere for PowerMax 9.2.4.18 (Dell) Fixed in 9.2.4.19
Fix · CNA Unisphere for PowerMax Virtual Appliance 9.2.4.17 (Dell) Fixed in 9.2.4.19

Timeline

2026-10-02 Threatist record created from CVE-2026-26357
2026-10-03 Alias added: GHSA-3q38-qghq-9hmp

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000402262/dsa-2025-425-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities

TI-2026-18287 Hard-coded credentials in Dell RecoverPoint for Virtual Machines KEVCVSS 3.1CRITICAL 10.0
TI-2021-04636 Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which… KEVCVSS 3.1HIGH 8.8
TI-2025-24909 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
TI-2018-01121 Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability… CVSS 3.0CRITICAL 9.8
TI-2020-09565 The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. KEVCVSS 3.1MEDIUM 5.4
TI-2022-08298 Improper authentication in Dell Integrated Dell Remote Access Controller 9 CVSS 3.1CRITICAL 9.8

See all 2081 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences