What is the CVSS score of CVE-2026-28262?

CVE-2026-28262 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28262?

Yes, a patch is available for CVE-2026-28262. Update the affected software to the latest version immediately.

Dell iDRAC Tools CVE-2026-28262

EUVD-2026-35381 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-06-09 dell

GHSA-p8vp-j99r-cghm

Information Disclosure Dell

6.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 10:01 EUVD

Analysis Generated

Jun 09, 2026 - 09:19 vuln.today

DescriptionCVE.org

Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

AnalysisAI

Link-following (symlink attack) in Dell iDRAC Tools versions prior to 11.4.1.0 allows a low-privileged local attacker to redirect file operations to unintended targets, resulting in unauthorized modification of files (high integrity impact) and potential availability disruption. Exploitation requires both low-level local access and user interaction, placing this in a constrained attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and no EPSS score was supplied in source data.

Technical ContextAI

CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes a class of vulnerability where an application resolves a symbolic or hard link without validating that the resolved path is the intended target. In the context of Dell iDRAC Tools - software used to manage out-of-band server management controllers (iDRAC) from the host OS - the application likely performs privileged file operations (reads, writes, or installs) while processing paths that a low-privileged user can influence. By substituting a legitimate path with a symlink pointing to a sensitive system file, an attacker causes the privileged iDRAC Tools process to operate on the attacker-chosen target instead. The affected CPE is cpe:2.3:a:dell:idrac_tools:*:*:*:*:*:*:*:*, covering all versions of the software application (not the firmware) prior to 11.4.1.0.

RemediationAI

Upgrade Dell iDRAC Tools to version 11.4.1.0 or later, as confirmed by Dell advisory DSA-2026-239 (https://www.dell.com/support/kbdoc/en-us/000474864/dsa-2026-239-security-update-for-dell-idrac-tools-vulnerability). If immediate patching is not feasible, restrict local interactive access to servers running iDRAC Tools to only fully trusted administrators, eliminating the low-privilege local attacker prerequisite - this is the most effective compensating control given AV:L and PR:L requirements. Additionally, enabling OS-level protections against symlink attacks (such as the Linux protected_symlinks kernel parameter: fs.protected_symlinks=1) can raise the bar for exploitation but may affect other application behaviors and should be tested before production deployment. Monitoring privileged file operations via auditd rules on iDRAC Tools binaries can provide detection capability while a patch window is scheduled.