Act
active
Dell CSM Critical Flaws Enable Unauth Admin Access and Kubernetes Root
- Engineer — Act: CVE-2026-63688 scores CVSS 10.0 with a public PoC on GitHub — unauthenticated root on Kubernetes nodes is maximum-severity. Apply Dell’s CSM patch immediately and audit csm-authorization-storage gRPC server access logs for any unauthorized calls since before the patch date.
- SOC/IR — Act: A public PoC against a CVSS 10.0 unauthenticated gRPC endpoint means exploitation attempts are likely in the wild. Hunt for anomalous Kubernetes node privilege escalation events and unexpected gRPC calls to csm-authorization-storage, and flag any Kubernetes admin actions that postdate the vulnerability’s public disclosure.
- Leader — Skip
- Signals: CVE-2026-63688 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.