CVE-2026-35161 Dell CVE debrief

Who should care

Defenders responsible for Dell PowerScale InsightIQ systems, remote access controls, and authentication mechanisms should assess exposure and prioritize verification. This includes IT security teams, system administrators, and network defenders who manage or monitor Dell PowerScale InsightIQ deployments. They should review the vendor advisory for specific patch guidance and assess the potential impact on their systems.

Why it matters

Defenders should prioritize verifying exposure and assessing remote access controls due to the potential for Denial of service through account lockout in Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0.

• Denial of service through account lockout

Technical summary

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. The vulnerability is due to an overly restrictive account lockout mechanism that could be triggered by an attacker, resulting in a Denial of service. Defenders should assess exposure based on their environment's configurations and apply patches or mitigations as recommended by the vendor.

Defensive priority

Defenders should prioritize verifying exposure and assessing remote access controls.

Recommended defensive actions

• Verify exposure by checking PowerScale InsightIQ versions 5.2.0 through 6.3.0
• Assess remote access controls and authentication mechanisms
• Review and update account lockout policies
• Apply vendor patches or updates according to the vendor's guidance
• Monitor for unusual account lockout activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and vendor advisory provide details on the vulnerability. The CVE Program record (CVE-2026-35161) and the NIST NVD detail page (CVE-2026-35161) offer source-provided CVE metadata and vulnerability assessments. The vendor advisory also provides guidance on affected versions and patching. However, specific details about the number of affected systems or confirmed exploitation attempts are not publicly available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.