Dell has released patches addressing six critical security flaws discovered in the Container Storage Modules (CSM), the integration layer that bridges Dell enterprise storage arrays with Kubernetes environments. The company's CSM platform provides extended functionality beyond standard Container Storage Interface (CSI) drivers for Kubernetes and supports Dell's major storage solutions including PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT.

In a security advisory released Thursday, Dell identified two maximum-severity vulnerabilities stemming from authentication gaps in the CSM Authorization security module. The first vulnerability, designated CVE-2026-63688, permits unauthenticated remote attackers to retrieve storage backend administrator credentials across all registered storage arrays and circumvent authorization mechanisms to obtain complete administrative control of the storage infrastructure.

The second maximum-severity flaw, tracked as CVE-2026-63692, resides in the authorization proxy and tenant service components. This vulnerability similarly enables threat actors to bypass authentication controls and escalate to administrative privileges. Dell characterized the risk in stark terms: "This vulnerability is considered critical as it enables an unauthenticated attacker to gain complete administrative control over the authorization service, potentially allowing unauthorized access to and manipulation of storage resources across all tenants."

On the same day, Dell addressed four additional critical-severity issues affecting CSM. These vulnerabilities permit unprivileged remote attackers to execute several attack scenarios:

  • Achieve root-level access on cluster nodes (CVE-2026-67269)
  • Obtain administrative access to the CSM Authorization proxy (CVE-2026-54472)
  • Forge authentication tokens to acquire administrative privileges (CVE-2026-61421)
  • Circumvent Kubernetes access controls to read Kubernetes Secrets cluster-wide (CVE-2026-67273)

Dell stated that "customers to upgrade at the earliest opportunity" and directed organizations to update their container storage modules to version 1.18.0 or later to remediate these vulnerabilities.

Dell vulnerabilities exploited in the wild

Although Dell has not yet reported active exploitation of these newly patched flaws, state-sponsored threat actors have previously targeted Dell products. The North Korean Lazarus group deployed a Windows rootkit by exploiting an insufficient access control flaw (CVE-2021-21551) in the Dell dbutil driver.

More recent incidents demonstrate continued targeting of Dell infrastructure. In February, Mandiant and the Google Threat Intelligence Group disclosed that a suspected Chinese state-backed group designated UNC6201 had been exploiting a maximum-severity hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024. The attackers leveraged this flaw to deploy malware and establish hidden network interfaces on VMware ESXi servers.

Researchers identified connections between UNC6201 and Silk Typhoon, a Chinese cyberespionage outfit known for deploying custom Spawnant and Zipline malware against government agencies through Ivanti zero-day exploits.

In response to the Dell RecoverPoint vulnerability, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated that government agencies patch affected Dell systems within three days.