CVE-2025-36595: dell solutions_enabler_virtual_appliance Static Code Injection

Vulnerability summary

CVE-2025-36595 is a high (CVSS 7.2) Static Code Injection vulnerability in dell solutions_enabler_virtual_appliance. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities.

Timeline

1. 27-06-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

• CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.