Dell AIOps Collector
CVE-2026-32652
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local console access required (AV:L) with a low-privileged account (PR:L); default credentials make complexity low (AC:L) and yield full filesystem control, so C/I/A all High.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console access could potentially exploit this vulnerability to gain Filesystem access. This vulnerability only affects fresh installations of Collector versions earlier than 1.18.3. Systems that have been upgraded (either manually or automatically) to version 1.18.3 or later are not impacted, even if they were originally installed on an earlier version.
AnalysisAI
Local privilege escalation in Dell AIOps Collector versions prior to 1.18.3 allows a low-privileged attacker with console access to obtain filesystem-level access by abusing default credentials shipped with fresh installations. The flaw only affects systems freshly installed at an earlier version; upgraded hosts are not impacted. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
Technical ContextAI
Dell AIOps is Dell's AI-driven IT operations monitoring/observability platform, and the Collector is the on-host agent responsible for telemetry gathering from monitored infrastructure (cpe:2.3:a:dell:aiops:*). The root cause is CWE-1392 (Use of Default Credentials), meaning the product ships with predictable or static credentials configured at install time that are not rotated or randomized per deployment. Because the default credentials persist only on fresh installs of versions earlier than 1.18.3, the install-time provisioning logic in older releases is the defective component; later upgrade paths overwrite or rotate the offending credentials, which is why upgraded hosts are unaffected.
RemediationAI
Vendor-released patch: Dell AIOps Collector 1.18.3 - upgrade all affected fresh installations to 1.18.3 or later per Dell DSA-2026-231 (https://www.dell.com/support/kbdoc/en-in/000477931/dsa-2026-231-security-update-for-dell-aiops-collector-for-default-credential-vulnerability), which is the authoritative fix and which, once applied, persists across subsequent upgrades. Where immediate patching is not feasible, manually rotate the default credentials on the Collector host (consult Dell support for the supported procedure to avoid breaking telemetry collection), restrict interactive console and local logon rights on Collector hosts to a minimal set of administrators, and enforce endpoint logging/EDR on those hosts so that any abuse of the default account is detected; note that credential rotation may require re-pairing the Collector with its management plane and that locking down console access can complicate legitimate operator troubleshooting.
Same weakness CWE-1392 – Use of Default Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today