Dell Terraform Provider for PowerFlex: OS command injection in SDC host provisioning
Summary
The Dell Terraform Provider for PowerFlex contains an OS command injection vulnerability (CWE-78) in its SDC host provisioning component. A remote attacker with high privileges on the PowerFlex management plane can execute arbitrary OS commands on provisioned SDC hosts, which may lead to full compromise of those hosts. The attack complexity is high, and no public exploit or exploitation in the wild is known at the time of publication.
Affected
- Terraform Provider for PowerFlex versions 1.5.0 through 1.8.0 (per Dell advisory DSA-2026-433)
- The CVE record lists versions before 1.9.0; versions before 1.5.0 are not confirmed by the vendor excerpt.
Fixed in
- Version 1.9.0 or later (per Dell advisory DSA-2026-433 and secondary sources; verify on the Dell advisory page).
Workaround
Unknown. No vendor-stated workaround was found. Upgrading is the only identified remediation.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV at the time of research.
- No public proof of concept found. The CVE was published on 2026-11-11, so this status may change quickly.
Our recommendation
- Check whether the Terraform Provider for PowerFlex is in use and which version is deployed.
- Upgrade to version 1.9.0 or later.
- Restrict access to the PowerFlex management plane and review accounts with high privileges.
- Review who can run Terraform against PowerFlex and protect automation credentials and CI pipelines.
- Monitor for unexpected commands on SDC hosts and re-check the Dell advisory and KEV for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-433 Security Update www.dell.com
- Dell Terraform Provider for PowerFlex releases (GitHub) github.com
- Terraform Provider for PowerFlex (GitHub) github.com
- CVE-2026-68862 mirror (threatint) cve.threatint.com
- CVE-2026-68862 summary (offseq radar) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:27.
Original description (NVD)
Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.