Soon55Critical10.0VulnerabilityCVE-2026-63688No patch link observed

CVE-2026-63688 — Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-a…

Published Oct 6, 2026, 03:17 PM UTCIngested 2d agoSource NVD(cve-db)CVE-2026-63688

Description

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

CVSS v3.1 base metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10.0

Critical severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

Network

Attack Vector

Low

Attack Complexity

None

Privileges Required

None

User Interaction

Changed

Scope

High

Confidentiality

High

Integrity

High

Availability

Affected

Vendor: dell
Product: container storage modules

Versions

< 1.18.0

Stated as the source expressed them.

References

vendorVendor Advisoryhttps://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9

Related threats

same CWE or vendor

Critical

CVE-2026-84249 — IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authenticatio…

CVE-2026-84249 · 1h ago

High

CVE-2026-11318 — Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged…

CVE-2026-11318 · 2h ago

Critical

CVE-2026-107779 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin Job…

CVE-2026-107779 · 2h ago

Critical

CVE-2026-84272 — IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component.

CVE-2026-84272 · 3h ago

Critical

CVE-2026-104076 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote una…

CVE-2026-104076 · 3h ago

High

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

CVE-2026-61435 · 4h ago

Risk score

Soon55

0-100, weighted from severity/CVSS and EPSS, with known-exploited status as a floor rather than a weighted input — see below.

·CVSS 10.0/10
·EPSS 0.8% chance of exploitation in 30 days, 55th percentile

Upstream records

Exploit prediction

EPSS

0.8%chance of exploitation in 30 days

Higher than 54.9% of all scored CVEs.

FIRST.org EPSS, scored Oct 8, 2026, 12:00 PM UTC. Probability of exploitation, not severity — a low-CVSS bug with a high EPSS is still the one being used today.

Classification

Severity: Critical
CVSS score: 10.0
Type: Vulnerability
Source type: cve-db

Weaknesses

CWE-306

AI enrichment

Not yet enriched. This runs on a schedule for new critical/high threats and has not reached this record yet.

Provenance

External ID: CVE-2026-63688
Slug: cve-2026-63688
Last updated: Oct 8, 2026, 02:40 PM UTC

The untouched source payload is retained in the record's raw field: ?include=raw