What is the CVSS score of CVE-2026-23857?

CVE-2026-23857 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Update Package Framework are affected by CVE-2026-23857?

Dell Update Package (DUP) Framework versions 23.12.00-24.12.00 contain a privilege escalation vulnerability that allows low-privileged local users to gain elevated system access.

How to fix or mitigate CVE-2026-23857?

Within 24 hours: Inventory all systems running DUP Framework versions 23.12.00-24.12.00 and restrict local user account access to affected systems. Within 7 days: Implement network segmentation to isolate affected Dell systems and disable DUP auto-update features where operationally feasible. Within 30 days: Develop and test an upgrade plan to versions prior to 23.12.00 or monitor Dell security advisories for patch availability; establish enhanced logging and monitoring for privilege escalation attempts on affected systems.

Update Package Framework CVE-2026-23857

HIGH

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-02-12 security_alert@emc.com

Information Disclosure Dell Update Package Framework

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 03:15 nvd

HIGH 8.2

DescriptionCVE.org

Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Dell Update Package Framework versions 23.12.00 through 24.12.00 suffers from improper privilege handling that allows local attackers with low-level user accounts to escalate their privileges on affected systems. An attacker with interactive access could exploit this vulnerability to gain elevated permissions, potentially compromising system integrity and confidentiality. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Affects Update Package Framework. Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.