Patchfirst
Patchfirst
CVE-2026-63688 Critical · 10.0 EPSS 0.5%

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical…

Dell · Dell Container Storage Modules (CSM)

Summary

Dell Container Storage Modules (CSM) prior to v1.18.0 has a missing authentication for critical function flaw in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially reach that server without credentials and gain access to storage backend administrator credentials for all registered storage arrays.

Official description · NVD

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

Breakdown
17.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 6 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 11 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Vendor Advisory 1

dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9
↑ ↓ chooseEnter openEsc close