Dell asks admins to patch max severity CSM flaws as soon as possible

Dell has released fixes for six critical-severity vulnerabilities in its Container Storage Modules (CSM), the component that links Dell storage arrays like PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT to Kubernetes clusters. Two of the flaws, CVE-2026-63688 and CVE-2026-63692, sit in the CSM Authorization module and let an unauthenticated attacker retrieve storage backend admin credentials or hijack the authorization proxy and tenant service to gain full administrative control over the storage environment. Four additional bugs—CVE-2026-67269, CVE-2026-54472, CVE-2026-61421 and CVE-2026-67273—can be abused without credentials to obtain root on cluster nodes, seize control of the authorization proxy, forge authentication tokens, or read Kubernetes Secrets across all tenants. Dell has not reported any active exploitation of these issues but urges customers to upgrade to CSM version 1.18.0 or later as soon as possible, noting that other Dell products have previously been targeted by state-sponsored groups such as Lazarus and a China-linked actor exploiting a RecoverPoint flaw.