Dell released October patches addressing 18 critical vulnerabilities in its Container Storage Modules (CSM) and Dell System Update (DSU), including two CVSS 10.0 flaws and five more rated 9.0 or higher.

The security updates for Dell CSM address susceptible configurations that could allow unauthenticated access or privilege escalation on Kubernetes nodes and storage infrastructure.

Four additional critical flaws include CVE-2026-67269 (9.9) enabling root access on Kubernetes cluster nodes; CVE-2026-54472 (9.8) for hard-coded credentials to forge admin tokens; CVE-2026-61421 (9.8) exposing a JWT signing secret in an archived component; and CVE-2026-67273 (9.6) granting cluster-wide read access to Kubernetes Secrets.

Security researchers describe the flaws as a theoretical “wish list for every ransomware group” due to targeting enterprise storage and container orchestration, with no active exploitation reported but prior interest from Lazarus and UNC6201.

A separate high-severity flaw in Dell System Update (CVE-2026-86360) scores 9.6 and allows remote code execution with root privileges on PowerEdge servers.

Exploitation could enable cluster-wide read access to Kubernetes Secrets and creation of cluster-scoped RBAC resources, effectively bypassing Kubernetes access controls.

Affected products include all CSM versions before 1.18.0 (integrating with PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT on Kubernetes) and DSU versions before 2.3.0.0.

CVE-2026-54472 has a CVSS score of 9.8 and involves hard-coded credentials in the CSM Authorization module, enabling forging of administrative tokens and unauthorized access to the CSM Authorization proxy.

CVE-2026-63692 has a CVSS score of 10.0 and could allow an unauthenticated attacker to bypass authentication controls and gain administrative privileges via the authorization proxy and tenant service.

CVE-2026-67273 has a CVSS score of 9.6 and involves improper neutralization of special elements in a template engine, enabling a low-privilege attacker with remote access to escalate privileges, access sensitive data, and tamper RBAC.

The vulnerabilities affect all CSM versions prior to 1.17.0 and are fixed in 1.18.0; Dell notes there are no workarounds besides upgrading.

Dell urges upgrading to CSM 1.18.0 and DSU 2.3.0.0 immediately; for CVE-2026-54472, rotate JWT signing secrets after patching.