CVE-2026-63688

No known exploitation. EPSS puts it in the 55th percentile. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile55th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products2 fixed builds listed below

Published 2026-10-06Updated 2026-10-08Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Dell Container Storage ModulesAffected: < 1.18.0 or laterUpgrade to: 1.18.0 or laterStated by: CVE record
Dell Container Storage ModulesAffected: < 1.18.0Upgrade to: 1.18.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization runs Dell Container Storage Modules (CSM) in your Kubernetes/container environment, and confirm the version.
Identify if the csm-authorization-storage gRPC service is reachable from any network (internal or internet).
Upgrade Dell CSM to version 1.18.0 or later, which fixes this issue.
After upgrading, rotate credentials for any storage backends that were registered with the affected CSM instance, since old credentials may already be exposed.
Restrict network access to the csm-authorization-storage service to trusted internal systems only, as a safeguard going forward.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Vendor patch released
as reported · Oct 2, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 2 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

In plain language

Written by AI from the record

If your business uses Dell's container storage software (CSM) to manage storage for containerized apps, an outside attacker could steal the master passwords to all your connected storage systems without needing a username or password — you should update now.

Missing Authentication for Critical Function (CWE-306) in the csm-authorization-storage gRPC server of Dell CSM prior to 1.18.0 allows an unauthenticated network attacker to directly query the exposed gRPC service and retrieve storage backend administrator credentials for all registered arrays.

If you're affected

Storage admin credential theft
Full storage backend compromise
Data exposure across all storage arrays
Operational disruption to storage services

What is it

Think of this software as a vault manager that holds the master keys to all your company's storage systems. This flaw is like leaving a side door to the vault unlocked — anyone who can reach that door over the network can walk in and copy every master key without showing ID. Once they have those keys, they can access the storage systems those keys unlock.

Who is affected

This matters to you if your organization runs Dell Container Storage Modules (CSM) to manage storage for containerized applications, especially in Kubernetes environments. It affects any version before 1.18.0. This is a risk if the internal csm-authorization-storage service is reachable from any network — including internal networks, not just the internet — since no login is required to exploit it.

How urgent is it

This is a critical, no-login flaw that lets attackers remotely steal the master credentials to every connected storage system, and it has already drawn attention from the threat actor group ShinyHunters following its disclosure. There is no confirmed active exploitation yet, but given the severity and the attention it's receiving, treat this as an urgent, high-priority fix — don't wait.

What to do — in detail

Confirm exposure by checking whether csm-authorization-storage gRPC endpoints are reachable from any network segment, including internal pods/services that shouldn't be exposed; use network policies or service mesh logs to verify. Upgrade Dell CSM to 1.18.0 or later across all clusters running the affected component — review Dell's release notes for any breaking changes in the upgrade path from your current version. If immediate patching isn't possible, apply network-level restrictions (NetworkPolicy, firewall rules, or service mesh authorization) to block all but trusted internal callers from reaching the gRPC service as a temporary mitigation. After patching, rotate all storage backend administrator credentials that were registered with CSM prior to the upgrade, since they may have already been exposed. This CVE is not currently in CISA's KEV catalog and no in-the-wild exploitation has been confirmed, but monitor vendor advisories and threat intelligence closely given the attention from the ShinyHunters actor group, and watch for any unusual authentication attempts against registered storage arrays.

Technical context

CVSS 3.1 score of 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — reflects network-exploitable, no privileges or user interaction required, with full confidentiality, integrity, and availability impact and a scope change. The weakness is CWE-306 (Missing Authentication for Critical Function) in the csm-authorization-storage gRPC server, reachable in default configuration. No public exploit code is known and the CVE is not listed in CISA's KEV catalog; news reporting shows no dated in-the-wild exploitation claim, only vendor disclosure. However, PULSE flags fresh press attention tied to the actor group ShinyHunters around the patch release, warranting elevated caution despite lack of confirmed exploitation. Fixed in Dell CSM 1.18.0.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS55th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 55th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 2 days, from the signal feeds we watch.

2026-10-08Patch availablerecord updated
2026-10-06Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Dellcommercial · USaka dell technologies
- Dell Container Storage Modules (CSM)On-premEnterprise Software / itsm-monitoring
- container storage modulesMixedEnterprise Software

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable