Soon55Critical9.9VulnerabilityCVE-2026-67269No patch link observed

CVE-2026-67269 — Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerSto…

Published Oct 6, 2026, 03:17 PM UTCIngested 2d agoSource NVD(cve-db)CVE-2026-67269

Description

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.

CVSS v3.1 base metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.9

Critical severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

Network

Attack Vector

Low

Attack Complexity

Low

Privileges Required

None

User Interaction

Changed

Scope

High

Confidentiality

High

Integrity

High

Availability

Affected

Vendor: dell
Product: container storage modules

Versions

< 1.18.0

Stated as the source expressed them.

References

vendorVendor Advisoryhttps://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9

Related threats

same CWE or vendor

High

CVE-2026-84245 — IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component.

CVE-2026-84245 · 3h ago

High

CVE-2026-50054 — An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant anothe…

CVE-2026-50054 · 6h ago

High

CVE-2026-93017 — The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or …

CVE-2026-93017 · 8h ago

Critical

CVE-2026-107510 — An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

CVE-2026-107510 · 13h ago

Critical

CVE-2026-103692 — The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated user…

CVE-2026-103692 · 17h ago

High

CVE-2026-94578 — Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) in…

CVE-2026-94578 · 20h ago

Risk score

Soon55

0-100, weighted from severity/CVSS and EPSS, with known-exploited status as a floor rather than a weighted input — see below.

·CVSS 9.9/10
·EPSS 0.5% chance of exploitation in 30 days, 43th percentile

Upstream records

Exploit prediction

EPSS

0.5%chance of exploitation in 30 days

Higher than 43.3% of all scored CVEs.

FIRST.org EPSS, scored Oct 8, 2026, 12:00 PM UTC. Probability of exploitation, not severity — a low-CVSS bug with a high EPSS is still the one being used today.

Classification

Severity: Critical
CVSS score: 9.9
Type: Vulnerability
Source type: cve-db

Weaknesses

CWE-269

AI enrichment

Not yet enriched. This runs on a schedule for new critical/high threats and has not reached this record yet.

Provenance

External ID: CVE-2026-67269
Slug: cve-2026-67269
Last updated: Oct 8, 2026, 06:39 PM UTC

The untouched source payload is retained in the record's raw field: ?include=raw