CVE-2026-54472

No known exploitation. EPSS puts it in the 42nd percentile. Fixed in 1.18.0 or later.

CVSS 3.19.8Critical EPSS percentile42nd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.18.0 or laterUpgrade to this build

Published 2026-10-06Updated 2026-10-08Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Dell Container Storage ModulesAffected: < 1.18.0 or laterUpgrade to: 1.18.0 or laterStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of Dell Container Storage Modules your team is running.
If it is older than 1.18.0, treat it as vulnerable — this includes any default install, since no special configuration is needed.
Upgrade to version 1.18.0 or later as soon as possible.
After upgrading, ask your IT team to rotate any credentials associated with the storage modules, since the old ones were effectively public.
Confirm with your vendor or managed service provider that the fix has been applied if Dell CSM is managed on your behalf.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Vendor patch released
as reported · Oct 2, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8

In plain language

Written by AI from the record

If you use Dell's Container Storage Modules before version 1.18.0, hidden built-in passwords let anyone on the network log in and read your private data without an account — this is serious and should be fixed now.

CWE-798 hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules allow unauthenticated, network-reachable attackers to authenticate and disclose sensitive information with no user interaction required.

If you're affected

Unauthorized data access
Customer/internal data exposure
Full remote account bypass
Compliance/audit exposure

What is it

Think of this like a hotel that printed its master key's combination in a public brochure — anyone who picks up that brochure can walk into any room, no key card needed. Here, the 'brochure' is the product's own documentation files, which contain a working password baked right into the software. Anyone on the network who finds it can log in as if they were an authorized user and access private data.

Who is affected

This matters to you if you run Dell Container Storage Modules, typically as part of a Kubernetes or container storage setup, on a version earlier than 1.18.0. Because the flaw is reachable over the network with no account needed, any instance exposed to a network — internal or internet-facing — is at risk until upgraded.

How urgent is it

This is a critical-severity flaw (rated 9.8 out of 10) that requires no account, no user interaction, and no special network position — anyone who can reach the system can log in using passwords baked into the product itself. There is no confirmed active exploitation yet, but the ease of exploitation and the severity of what an attacker gains (full read/write access to sensitive data) means this should be treated as an emergency, not something to defer.

What to do — in detail

Inventory all deployments of Dell Container Storage Modules and identify exact version numbers in use; anything prior to 1.18.0 is vulnerable since the hard-coded credentials live in the csm-docs/Authorization module and are reachable with no authentication (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Upgrade to Container Storage Modules 1.18.0 or later — check Dell's release notes for this version for any breaking changes relevant to your Kubernetes/CSI integration before rolling out.
There is no safe workaround that fully mitigates this short of upgrading, since the credentials are embedded in the shipped code; restrict network access to the CSM management/authorization endpoints as a stop-gap via network segmentation or firewall rules if upgrade must be delayed.
After upgrading, rotate any credentials, tokens, or secrets that may have been protected by or derived from the affected Authorization module, since the hard-coded values should be considered compromised.
Not currently listed in CISA KEV and no public exploit code or confirmed in-the-wild exploitation has been reported, but monitor Dell security advisories and threat intel (this CVE has drawn press attention in a batch disclosure referencing the actor ShinyHunters) for any change in exploitation status.

Technical context

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. Weakness is CWE-798 (Use of Hard-coded Credentials) located in the csm-docs/Authorization component. Not present in CISA's Known Exploited Vulnerabilities catalog; no public exploit code identified; no dated press claim of active exploitation, only disclosure coverage referencing the actor ShinyHunters in a roundup context. Fixed in Container Storage Modules 1.18.0; exploit maturity is currently theoretical/PoC-absent despite the trivial attack complexity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS42nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 42nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 2 days, from the signal feeds we watch.

2026-10-08Patch availablerecord updated
2026-10-06Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Dellcommercial · USaka dell technologies
- Container Storage ModulesMixedEnterprise Software

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable