Dell patched a trio of bugs leaving its PowerFlex Manager orchestration software vulnerable to attack. The most serious is a critical root-command injection flaw that could allow an adversary to commandeer the device.
Tracked as CVE-2026-56688 and with a CVSS severity rating of 9.1, Dell says the vulnerability allows a high privileged attacker with remote access to potentially exploit the vulnerability during OS Repository processing and achieve arbitrary command execution as root, “potentially leading to full appliance compromise and lateral movement into managed infrastructure.”
This flaw is a root-command injection flaw, which is a bug that allows an attacker to smuggle their own operating-system commands into the software, and those commands execute with full administrator-level control rather than some limited, sandboxed permission level.
PowerFlex Manager is the orchestration layer for Dell’s PowerFlex software-defined storage platform, used to provision and manage storage clusters in enterprise data centers. Dell recently repositioned PowerFlex as part of what it now calls “Dell Exascale Storage” — the company named it as one of the underlying platforms for large-scale enterprise AI deployments, including Palantir’s on-premises Foundry rollout through the Dell AI Factory.
A second Dell PowerFlex Manager SQL injection flaw was also patched (CVE-2026-56690) that carries a lower severity score of CVSS 7.7. The flaw, according to Dell, lets a low-privileged attacker with remote access exploit improperly neutralized SQL syntax to reach information disclosure, information exposure and unauthorized access.
A third SQL Injection vulnerability (CVE-2026-56689) with a severity rating of CVSS 7.7 is also rated as a high severity vulnerability. This is a narrower version of the same SQL injection class as CVE-2026-56690 and limited to information exposure.
A SQL injection is when software takes a user-supplied input — a search box, a login field, a URL parameter, an API request — and inserts it directly into a database query without properly separating “data” from “instructions” first. The database can’t tell the difference between a benign value a user entered and a malicious command an attacker snuck in, so it just runs whatever input it receives.
All three affect PowerFlex Manager versions prior to 5.1.0.1, and are remediated in that version, per Dell’s advisory.
