CVE-2025-36599: Dell PowerFlex Manager VM · Sensitive Data in Logs
Affects Dell PowerFlex Manager VMSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium : upgrade to 4.6.2.1 when convenient.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 4.6.2.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade Dell PowerFlex Manager VM to 4.6.2.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Dell PowerFlex Manager VM | Affected
| Fixed in
|
AI-suggested
European organizations should prioritize the following mitigation steps: 1) Upgrade Dell PowerFlex Manager VM to version 4.6.2.1 or later as soon as the patch becomes available to eliminate the vulnerability at the source. 2) Restrict remote access to the management interface using network segmentation, VPNs, or IP whitelisting to limit exposure to low-privileged attackers. 3) Implement strict access controls and monitor logs for unusual access patterns, especially focusing on attempts to access or exfiltrate log files. 4) Encrypt log files at rest and in transit to reduce the risk of credential disclosure if logs are accessed. 5) Regularly audit and rotate credentials used by PowerFlex Manager VM to minimize the window of opportunity for attackers leveraging exposed credentials. 6) Employ intrusion detection and prevention systems to detect anomalous activities related to credential misuse. 7) Educate administrators on secure logging practices and the risks of sensitive data in logs to prevent similar issues in custom configurations or future deployments.
Description
Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.