Quick answers
- Is CVE-2026-54470 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54470 being exploited in the wild.
- How severe is CVE-2026-54470?
- Medium severity, with a CVSS score of 5.3, published 10 July 2026.
- Which products and versions are affected?
- Dell Unisphere for PowerMax 10.3.0.5 and prior; Dell Unisphere For Powermax Virtual Appliance 10.3.0.5 and prior.
- Is there a fix for CVE-2026-54470?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-54470 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-54470?
- Check whether you run Dell Unisphere for PowerMax or Dell Unisphere For Powermax Virtual Appliance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Dell Unisphere for PowerMax contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611). The vulnerability exists in the way the application processes XML input, failing to properly restrict references to external entities. A remote attacker with low-level privileges can exploit this by sending a specially crafted XML payload to the server. Successful exploitation could allow the attacker to read local files, conduct server-side request forgery (SSRF), or gain unauthorized access to sensitive data. The issue is addressed in versions 10.3.0.7 and 10.3.1.1 Patch 11360 or later.
Affected products
- Dell Unisphere for PowerMax 10.3.0.5 and prior
- Dell Unisphere for PowerMax Virtual Appliance 10.3.0.5 and prior
Timeline
- 2026-07-10: advisory: Initial publication of DSA-2026-272 and NVD entry