Ing. Calogero Bono
The National Cybersecurity Agency published on November 13, 2026 the alert AL09/261113/CSIRT-ITA on Dell products. The manufacturer has released updates for numerous flaws, 11 of them rated critical and 23 rated high. They affect PowerStore T OS, Dell Networking OS10 and PowerScale InsightIQ. These are storage, networking and monitoring systems that often sit at the heart of the corporate infrastructure, so a problem here weighs more than on a single PC.
A few terms before we get into the facts. CSIRT Italia is the group within the ACN that handles alerts and response to cyber incidents. CVE is the code that uniquely identifies a known vulnerability. Authentication bypass means an attacker can skip the credential check. Privilege escalation is gaining permissions higher than those assigned. Denial of Service is blocking a service so it becomes unusable.
What did the ACN report about Dell?
According to the ACN alert, Dell has fixed numerous vulnerabilities. Those cited as most serious are 11 critical and 23 high, so 34 in total (the count is ours).
The agency specifies that the list of CVEs reported covers only the critical and high severities and does not include those of third-party products or components. The full picture is in the manufacturer's bulletins.
Which products and versions are involved?
The alert lists three product families.
- PowerStore T OS 5.1.x series, versions prior to 5.1.0.0-2798105.
- Dell Networking OS10 all versions prior to 10.6.0.10.
- PowerScale InsightIQ from 5.1.0 up to and including 6.4.0.
For details, the ACN refers to the "Affected Products & Remediation" section of each bulletin.
What kinds of attacks do they make possible?
The ACN lists eight types. Among them are arbitrary code execution, arbitrary file writing, reading and deletion, authentication bypass, denial of service, information disclosure, privilege escalation, circumvention of security restrictions and data tampering.
The alert does not say which flaw affects which product, nor whether any is already being exploited. To find out, you need to read the individual bulletins.
How should you respond?
The agency, in line with the manufacturer's statements, recommends updating the vulnerable products following the bulletins. There are three, one per product, on the Dell support site, bearing the identifiers DSA-2026-479 for PowerStore T, DSA-2026-438 for Networking OS10 and DSA-2026-480 for InsightIQ.
If you manage appliances of this kind, the first step is an inventory of the versions in use. The same method applies to other recent cases, such as the Citrix updates with 10 critical vulnerabilities.
Limits to know
The alert does not indicate network exploitation or public exploits, and it does not assign scores to individual flaws. We do not know which CVEs are the 11 critical ones for each product. The PowerStore versions are given only for the 5.1.x series. The text, at version 1.0, may be updated.
What changes for those working in digital
Anyone managing Dell storage, switches or monitoring systems needs to check versions right away. These are appliances that are rarely touched, and for that very reason they fall behind. Plan a maintenance window, because storage and network updates can require reboots. If your servers are managed by a provider, ask for written confirmation that the update was applied, even with a managed hosting and server service. The same reasoning applies to open source components, as in the case of MongoDB Server.
Our take
An alert like this is useful, but it leaves the hard work to the reader. Lumping together 34 serious flaws across three different products without saying which affects what forces you to read three bulletins in English. For a small business that is a real obstacle. The concrete risk is postponing because no one finds the time. In our view the right rule is simple – appliances that hold data and network traffic deserve the same urgency as exposed servers, even if nobody sees them.
Frequently asked questions
How many vulnerabilities did Dell fix?
The alert mentions numerous vulnerabilities. Of these, 11 are critical and 23 are high. The total of serious ones is therefore 34, by our count.
Which versions need updating?
PowerStore T OS 5.1.x prior to 5.1.0.0-2798105, all Networking OS10 versions prior to 10.6.0.10, and InsightIQ from 5.1.0 up to and including 6.4.0. For details, the bulletin for each product is what counts.
Are the flaws already being exploited?
The alert does not say. It reports no active exploitation or public exploits. Still, it is best to update without waiting.
Where can I find the bulletins?
On the Dell support site. They are linked in the ACN alert and carry the identifiers DSA-2026-479, DSA-2026-438 and DSA-2026-480.
Who published the alert?
CSIRT Italia of the ACN, with code AL09/261113/CSIRT-ITA, on November 13, 2026. This is version 1.0 of the document.
What to check in the coming weeks on Dell appliances
The alert is at its first version and may be revised. Keep an eye on both the ACN and the manufacturer's bulletins.
- Reread the ACN alert for any revisions beyond version 1.0.
- Compare each bulletin with your list of appliances and note which critical CVEs apply to you.
- After updating, verify that the installed version is at least the one indicated, for example 10.6.0.10 for Networking OS10.
