What is the CVSS score of CVE-2026-23862?

CVE-2026-23862 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dell are affected by CVE-2026-23862?

Dell ThinOS 10 contains a local privilege escalation vulnerability (CVE-2026-23862) that allows low-privileged local users to execute arbitrary commands and gain elevated access without requiring…. A patch is available.

How to fix or mitigate CVE-2026-23862?

Within 24 hours: Inventory all Dell ThinOS 10 deployments and identify systems running versions prior to 2602_10.0573. Within 7 days: Apply vendor patch to ThinOS 10 version 2602_10.0573 or later across all affected systems, prioritizing systems with high-privilege user accounts and administrative access. Within 30 days: Verify patch deployment completion and conduct access control review to restrict local user privileges on remaining systems.

Dell CVE-2026-23862

EUVD-2026-12476 HIGH

Command Injection (CWE-77)

2026-03-16 security_alert@emc.com

Dell Command Injection

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2602_10.0573_T10

EUVD ID Assigned

Mar 16, 2026 - 18:30 euvd

EUVD-2026-12476

Analysis Generated

Mar 16, 2026 - 18:30 vuln.today

CVE Published

Mar 16, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Dell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

AnalysisAI

Dell ThinOS 10 versions before 2602_10.0573 contain a command injection flaw that allows local attackers with low privileges to execute arbitrary commands and escalate their access rights. The vulnerability stems from improper sanitization of special elements in user-supplied input, requiring only local access and no user interaction to exploit. No patch is currently available.

Technical ContextAI

Dell ThinOS is a lightweight operating system designed for thin client devices used in virtual desktop infrastructure (VDI) environments. The vulnerability stems from improper neutralization of special elements used in commands (CWE-77), a classic command injection flaw where user-supplied input is not properly sanitized before being passed to system commands. This allows attackers to inject malicious commands that execute with elevated privileges. The affected product is specifically Dell ThinOS version 10, with versions prior to 2602_10.0573_T10 being vulnerable according to the ENISA EUVD database.

RemediationAI

Upgrade Dell ThinOS 10 to version 2602_10.0573 or later as specified in Dell's security advisory at https://www.dell.com/support/kbdoc/en-us/000435801/dsa-2026-122. Until patching can be completed, implement compensating controls including restricting physical access to affected thin clients, enforcing least privilege principles for local user accounts, and monitoring for suspicious command execution or privilege escalation attempts. Organizations should prioritize patching based on the exposure level of their thin clients and the sensitivity of data accessible through VDI sessions.