CVE-2026-54489 is a critical flaw (CVSS 9.1) in Dell Virtual Storage Integrator for VMware vSphere Client before 10.11.1.0. An unauthenticated remote attacker could obtain active session credentials and impersonate users, including administrators. Dell recommends upgrading to 10.11.1.0 or later at the earliest opportunity.
What's affected
- Dell Virtual Storage Integrator for VMware vSphere Client before 10.11.1.0, per the record.
- Fixed in 10.11.1.0, per the record, which quotes Dell's advice to upgrade at the earliest opportunity.
- The Dell advisory is DSA-2026-335. It covers multiple vulnerabilities, so read the full document.
How to check if you're exposed
In the vSphere Client, open the plug-in or appliance details for Dell Virtual Storage Integrator and read its version. If it is below 10.11.1.0, you are exposed. Then check where the appliance listens, because the record rates the flaw as exploitable remotely without authentication. List which networks can reach it.
What to do now
- Read Dell advisory DSA-2026-335 for the upgrade steps and other fixes in the same release.
- Upgrade Dell Virtual Storage Integrator to 10.11.1.0 or later.
- Restrict network access to the appliance to administrator workstations and the vCenter server.
- After upgrading, end active sessions and review administrator activity for the period before the update.
Why it matters
The class is CWE-200, exposure of sensitive information to an unauthorized actor. The record says an attacker could obtain active session credentials. A session credential works like a password for as long as it lives, so reading one is the same as logging in as that user.
Because the plug-in manages storage for vSphere, an administrator session can reach a lot. The record does not mark the CVE as exploited in the wild. The record does not state how the disclosure occurs, and neither does this post.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is there a workaround?
The record does not list one. Dell recommends upgrading, so plan that and limit network access until you do.
Sources
Last reviewed: 19 October 2026.
