External risk intelligence

Dell PowerStore Out-of-bounds Write Vulnerability in SMB/CIFS

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-67271

The vulnerability exists in the SMB/CIFS protocol implementation within a storage appliance. While reachable via network, SMB is typically restricted to internal network segments and is rarely exposed directly to the public internet in standard deployment configurations.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Dell PowerStore storage systems have a critical vulnerability in their network file sharing component that could allow an unauthenticated attacker to cause a denial of service or potentially execute remote code. This issue could lead to system crashes, persistent outages if automatic restarts are enabled, and a more sophisticated attacker could leverage it for remote code execution. The main concern is confirming relevance and exposure.

Unauthenticated attackers can crash storage systems.
Critical flaw could lead to denial of service or code execution.
Confirm relevance and exposure to this storage system issue.

Attack Path

How an attacker could exploit the issue

An attacker with network access could send a crafted SMB packet to the Dell PowerStore SDNAS, triggering an out-of-bounds write vulnerability in the SMB/CIFS component. This could result in a denial of service, with persistent crashes if automatic restarts are enabled, or potentially lead to remote code execution by a more skilled attacker.

Requires network access.
Triggered by crafted SMB packet.
Risk of denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could potentially exploit an out-of-bounds write vulnerability in Dell PowerStore's SMB/CIFS implementation. This could lead to a persistent denial of service if automatic restarts are enabled, or potentially remote code execution for a sophisticated attacker.

System data and availability.
Specially crafted SMB packets.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Dell PowerStore SDNAS, which handles SMB/CIFS, is likely managed by infrastructure or storage platform teams. The first practical step is to identify all PowerStore instances, determine their network exposure and business criticality, and then assign ownership for remediation planning.

Identify and confirm accountable owner.
Verify network exposure and criticality.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dell PowerStore SDNAS?

Dell PowerStore SDNAS is a software component within Dell PowerStore storage appliances. It manages the SMB/CIFS protocols, which enable file sharing and communication between the storage system and networked devices or servers. By handling these file requests, it acts as a critical interface for data access and storage operations in enterprise environments.

What does an Out-of-bounds Write mean for CVE-2026-67271?

This vulnerability, classified as CWE-787, occurs when the software writes data beyond the intended boundaries of a memory buffer. In this case, an attacker sends a specially crafted SMB packet that forces the system to write information into unauthorized memory areas. This memory corruption can cause the system to crash or, in more advanced scenarios, allow an attacker to execute their own malicious code.

How is this vulnerability triggered?

The flaw is triggered when the storage system processes a specially crafted SMB/CIFS packet sent by an unauthenticated user with network access. It is important to note that this is not triggered by normal, valid file sharing traffic; the packet must be specifically designed to exploit the memory handling error during the parsing process.

Is my Dell PowerStore at risk?

According to Halo Surface Signal, this vulnerability is classified as external due to its network-based attack vector, but its actual risk depends on your deployment. SMB/CIFS traffic is typically restricted to internal network segments and is rarely exposed directly to the public internet. Systems on isolated internal networks are much less accessible to potential attackers than those reachable from the public internet.

What should I do if I manage PowerStore systems?

Your first step is to perform an inventory of all PowerStore instances in your environment. Once identified, verify their specific network placement to determine if they are exposed to untrusted networks. After assessing the exposure and business criticality of each instance, coordinate with your infrastructure or storage teams to plan for the appropriate vendor-supplied security updates.

References

www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-power…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.