Integrated Dell Remote Access Controller CVE-2026-26948

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible attack surface with low complexity but high privilege requirement (PR:H), which significantly constrains real-world exploitability. The high confidentiality impact (C:H) reflects the severity of potential information disclosure. This is primarily an insider threat or compromised-administrator scenario; an attacker already holding high-privileged iDRAC credentials can remotely query debug information without user interaction. Without publicly available EPSS scores or confirmed KEV/CISA listing in the provided data, the practical risk depends on organizational exposure: widespread iDRAC deployments in enterprises increase risk, while properly segmented out-of-band networks reduce it. The vulnerability is not a remote code execution and requires existing authentication, making it lower priority than unauthenticated RCE issues but still significant for sensitive environments where credential compromise or insider threats are realistic threat models.

An administrator whose iDRAC credentials have been compromised (via phishing, credential stuffing, or lateral movement from a breached application server) can remotely connect to the iDRAC web interface or SSH service over the network. Once authenticated, the attacker navigates to diagnostic or debug sections (or queries debug APIs) to extract sensitive information such as system serial numbers, firmware versions, BIOS settings, thermal/power telemetry, or potentially embedded credentials used during server provisioning. This information enables the attacker to perform reconnaissance for further attacks or pivot to physical-level exploits. No additional user interaction or code execution is required.