Dell PowerFlex Manager <5.1.0.1: OS Command Injection
CVE-2026-56688 Published on July 10, 2026
Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability during OS Repository processing to achieve arbitrary command execution as root, potentially leading to full appliance compromise and lateral movement into managed infrastructure.
Vulnerability Analysis
CVE-2026-56688 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-56688 has been classified to as a Shell injection vulnerability or weakness.
Affected Versions
Dell PowerFlex Manager:- Before 5.1.0.1 or later is affected.
- Before 4.5.5.2 or later is affected.