Dell SRM and SMR Security Updates for Third‑Party Flaws

Affected Environment
Dell Storage Resource Manager and Dell Storage Monitoring and Reporting are affected when running versions prior to 6.0.0.2. Both Vapp and Windows/Linux deployments using bundled third‑party components such as SUSE, Tomcat, Java, Go, and MySQL are in scope.

Threat Overview
Vulnerabilities in multiple third‑party components may enable remote code execution, privilege escalation, unauthorized access, data disclosure, or DoS. If unpatched, compromised SRM/SMR instances can provide attackers with a foothold in environments where these products monitor or manage storage.

Exposure Timeline
Dell issued the security update advisory DSA‑2026‑111 and supporting software updates on 25 March 2026. Systems remain exposed from initial deployment until they are upgraded to version 6.0.0.2 or later.

Attack Surface
The exposed surface is the SRM/SMR application stack, including embedded OS, web server, Java runtime, compression libraries, Go, and MySQL. Accessible management interfaces and any network paths to SRM/SMR increase the chance that third‑party flaws can be triggered remotely.

Technical Root Cause
SRM and SMR ship with multiple third‑party components that contain known vulnerabilities tracked under the listed CVEs. These components include SUSE Linux Enterprise Server, Apache Tomcat, Java, Commons Compress, Go, and MySQL, which require vendor updates.

Exploitation Pathway
An attacker could leverage vulnerable services or libraries within SRM/SMR to run code, escalate privileges, access data, or cause DoS. Successful exploitation depends on reaching affected services in the SRM/SMR stack and invoking the specific vulnerable functionality.