What is the CVSS score of CVE-2026-21420?

CVE-2026-21420 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Repository Manager are affected by CVE-2026-21420?

Dell Repository Manager versions prior to 3.4.8 contain a privilege escalation vulnerability that could allow local attackers to execute arbitrary code and gain elevated system access.. A patch is available.

How to fix or mitigate CVE-2026-21420?

Within 24 hours: Identify all systems running Dell Repository Manager and document current versions. Within 7 days: Apply vendor patch 3.4.8 or later to all affected instances, prioritizing production and critical infrastructure systems. Within 30 days: Verify patch deployment across the entire environment and document completion for compliance records.

Repository Manager CVE-2026-21420

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-02-23 security_alert@emc.com

Privilege Escalation Repository Manager

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 24, 2026 - 21:56 nvd

Patch available

CVE Published

Feb 23, 2026 - 14:16 nvd

HIGH 7.3

DescriptionCVE.org

Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution and escalation of privileges.

AnalysisAI

Dell Repository Manager versions before 3.4.8 suffer from an uncontrolled search path vulnerability that allows local attackers with low privileges to execute arbitrary code and escalate their access. An attacker with local system access and user interaction can exploit improper path handling to inject malicious code into the application's execution flow. A patch is available to remediate this HIGH severity issue affecting the repository management functionality.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). Affects Repository Manager. Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution and escalation of privileges.