CVE-2026-22278 is a high severity flaw (CVSS 8.1) in Dell PowerScale OneFS versions before 9.13.0.0, where excessive authentication attempts are not restricted. An unauthenticated attacker with remote access could potentially gain unauthorized access to the cluster. Apply the fix described in Dell advisory DSA-2026-049.
What's affected
Dell PowerScale OneFS versions prior to 9.13.0.0.
The record points to Dell security advisory DSA-2026-049, which covers several vulnerabilities. Use that advisory for the list of remediated versions on each release line, since the record only says prior to 9.13.0.0.
How to check if you're exposed
On a cluster node, print the OneFS version:
isi version
Compare the result to the remediated versions in DSA-2026-049. Then check which interfaces accept logins from untrusted networks, because the flaw is reachable remotely.
What to do now
- Read Dell advisory DSA-2026-049 and pick the remediated version for your release line.
- Schedule the upgrade with your storage team, and test it first on a non production cluster if you have one.
- Until then, limit management and protocol access to trusted networks.
- Review authentication logs for large bursts of failed logins from one address.
- Turn on alerting for repeated failures against cluster accounts.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. Without a lockout or rate limit, an attacker can try guesses at machine speed. The attack complexity is rated high, because success still depends on guessing a valid credential, which is why the score is 8.1 and not 9.8.
Impact is high on all three axes because a cluster account can reach stored data. The record does not say it is exploited, and it is not on the CISA KEV list.
Quick check
Is this a remote flaw?
Yes. The record says an unauthenticated attacker with remote access could exploit it.
Where do I find the fixed versions?
In Dell advisory DSA-2026-049. The record only says versions before 9.13.0.0 are affected.
Sources
Last reviewed: 19 October 2026.
