# CVE-2026-24511: Dell PowerScale OneFS sensitive information disclosure in error messages

Source: https://junglewise.ai/threats/cve-2026-24511-dell-powerscale-onefs-sensitive-information-disclosure-in-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-24511 · Severity: medium · CVSS 4.4 · Published 2026-04-08

Dell PowerScale OneFS, an operating system used for high-performance network-attached storage, is affected by a vulnerability where system error messages may reveal sensitive information. An attacker who already has high-level administrative access to the local system could exploit this to view data they are not authorized to see. While the risk is mitigated by the requirement for high privileges, it could lead to further unauthorized data disclosure within the storage environment.

## Quick answers

**Is CVE-2026-24511 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24511 being exploited in the wild.

**How severe is CVE-2026-24511?** Medium severity, with a CVSS score of 4.4, published 8 April 2026.

**Which products and versions are affected?** Dell PowerScale OneFS 9.5.0.0 through 9.10.1.6, 9.11.0.0 through 9.13.0.0.

**Is there a fix for CVE-2026-24511?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24511 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-24511?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-209 (Generation of Error Message Containing Sensitive Information) exists in Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.6 and 9.11.0.0 through 9.13.0.0. The flaw occurs when the system generates error messages that inadvertently include sensitive technical or configuration data. An attacker with high privileges (PR:H) and local access (AV:L) can trigger these errors to facilitate information disclosure. The vulnerability is addressed in OneFS versions 9.10.1.7 and 9.13.0.1 or later.

## Affected products

- Dell PowerScale OneFS 9.5.0.0 through 9.10.1.6, 9.11.0.0 through 9.13.0.0

## Timeline

- 2026-04-06: advisory: Initial Dell security advisory (DSA-2026-125) released
- 2026-04-08: disclosed: CVE published to NVD

## References

- [https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000449337/dsa-2026-125-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities)