Dell CSM Critical Flaws Enable Unauth Admin Access and Kubernetes Root

Sat, 03 Oct 2026 15:08:49 +0000

Engineer — Act: CVE-2026-63688 scores CVSS 10.0 with a public PoC on GitHub — unauthenticated root on Kubernetes nodes is maximum-severity. Apply Dell’s CSM patch immediately and audit csm-authorization-storage gRPC server access logs for any unauthorized calls since before the patch date.
SOC/IR — Act: A public PoC against a CVSS 10.0 unauthenticated gRPC endpoint means exploitation attempts are likely in the wild. Hunt for anomalous Kubernetes node privilege escalation events and unexpected gRPC calls to csm-authorization-storage, and flag any Kubernetes admin actions that postdate the vulnerability’s public disclosure.
Leader — Skip
Signals: CVE-2026-63688 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Dell-Csm on CuraSec