Dell has released security advisory DSA-2026-479, which fixes 44 vulnerabilities in its PowerStore storage arrays. Seven of them carry a CVSS score of 9.8, and most of those sit in the SDNAS file services layer. No exploitation has been reported.
DSA-2026-479 Scope: 44 Dell-Specific PowerStore Vulnerabilities
The advisory covers 13 PowerStore models running software before PowerStore OS 5.1.0.0-2798105. Of the 44 Dell-specific flaws, 11 score 9.0 or higher, and 16 more fall between 8.0 and 8.8. That makes the bulk of the release high or critical severity.
Dell’s fix is a single upgrade path: move to PowerStore OS 5.1.0.0-2798105 or later. The source describing the advisory does not report any exploitation of the flaws.
CVE-2026-116443 Stack Overflow in the NAS TFTP Service
CVE-2026-116443 is a stack buffer overflow in the NAS TFTP service. An unauthenticated attacker could use it to cause a denial of service or execute code. Because it requires no credentials, it is among the most exposed of the seven 9.8 flaws.
Command Injection Bugs CVE-2026-116448 and CVE-2026-116449
CVE-2026-116448 and CVE-2026-116449 are command injection flaws that give root access on the NAS node. They require an internal attacker, meaning someone who already has a foothold inside the environment. Two further command injection flaws rated 9.1 also lead to root.
Path Traversal and Interconnect Driver Flaws Round Out the Critical Set
CVE-2026-116439 is a path traversal bug that lets an unauthenticated attacker read, modify or delete files. CVE-2026-116441, rated 9.6, is an out-of-bounds write in the storage-processor interconnect driver. An adjacent peer could use it to execute code as the system account.
Why the SDNAS File Services Layer Concentrates the Risk
Most of the 9.8-rated flaws cluster in SDNAS, the layer that provides file services on PowerStore. File-service components handle network-facing protocols such as TFTP and file access, so they present more reachable input than the block-storage internals. The pattern in this advisory fits that: unauthenticated flaws appear in the TFTP and path-handling code, while the injection flaws require an internal position.
What a PowerStore Compromise Would Put at Risk
PowerStore arrays hold primary data, virtual machines and file shares. A root shell on a NAS node, or code execution as system through the interconnect driver, would give an attacker direct access to data that sits beneath the applications and hypervisors that depend on it.
The coverage of the advisory does not give a Dell publication date; it appeared on November 2. Administrators running any of the 13 affected models face a single decision rather than a patchwork of fixes, since the one firmware upgrade closes all 44 listed vulnerabilities.
The advisory’s examples span several attack positions. CVE-2026-116443 and CVE-2026-116439 are reachable without authentication, CVE-2026-116448 and CVE-2026-116449 need an internal attacker, and CVE-2026-116441 requires an adjacent peer on the storage-processor interconnect. Each position carries a different exposure, but all lead to file access or code execution on the array. The upgrade to PowerStore OS 5.1.0.0-2798105 or later is the only fix Dell lists.
The severity distribution shows how the 44 fixes break down. Seven flaws score 9.8, one scores 9.6, two score 9.1, and the rest of the 11 flaws at 9.0 or above fall in the same critical band. Sixteen additional flaws range from 8.0 to 8.8, so the advisory leaves few low-severity items for administrators to defer. Dell’s affected-model count of 13 covers the PowerStore line running any release before OS 5.1.0.0-2798105, and the same upgrade covers every model.
The SDNAS layer matters because it exposes file services to the network. TFTP and file-path handling are reachable by design, which is why the two flaws in those areas, CVE-2026-116443 and CVE-2026-116439, carry unauthenticated attack paths. Dell’s advisory also includes flaws that depend on an attacker already being inside the environment, and those depend on how well administrators restrict access to the NAS nodes.
