What is the CVSS score of CVE-2026-32658?

CVE-2026-32658 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell Automation Platform are affected by CVE-2026-32658?

Dell Automation Platform versions before 2.0.0.0 contain a privilege escalation vulnerability allowing authenticated users to gain high-integrity system access, creating risk of unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-32658?

Within 24 hours: Identify all Dell Automation Platform instances and document current versions via Dell Systems Management Tools or administrative console. Within 7 days: Contact Dell support for patched version 2.0.0.0 or later availability for your deployment; test patches in non-production environment. Within 30 days: Apply vendor patch to all production instances per DSA-2026-193 guidance, with staged rollout by criticality; verify privilege escalation prevention post-deployment.

Dell Automation Platform CVE-2026-32658

EUVD-2026-29044 HIGH

Missing Authorization (CWE-862)

2026-05-11 dell

GHSA-fwp8-962p-2xcc

Authentication Bypass Dell

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 11, 2026 - 11:01 EUVD

Analysis Generated

May 11, 2026 - 10:31 vuln.today

CVE Published

May 11, 2026 - 08:43 nvd

HIGH 8.0

DescriptionCVE.org

Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Missing authorization in Dell Automation Platform before 2.0.0.0 allows authenticated remote attackers to elevate privileges to high-integrity access. The vulnerability requires low-level authentication and user interaction but enables complete compromise of confidentiality, integrity, and availability. CVSS 8.0 (High) reflects the significant impact despite the authentication prerequisite. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, though Dell has released patches per DSA-2026-193.

Technical ContextAI

This is a CWE-862 (Missing Authorization) vulnerability in Dell Automation Platform's access control mechanisms. The flaw occurs when the application fails to perform proper authorization checks after authentication, allowing low-privileged users to access or execute functionality intended for higher privilege levels. This class of vulnerability is distinct from authentication bypass - the attacker must have valid credentials but can then perform actions beyond their intended permission scope. Dell Automation Platform is an infrastructure orchestration and automation solution, where privilege escalation vulnerabilities are particularly critical as they can lead to unauthorized control over managed systems and infrastructure.

RemediationAI

Upgrade Dell Automation Platform to version 2.0.0.0 or later as specified in Dell Security Advisory DSA-2026-193 (https://www.dell.com/support/kbdoc/en-us/000458049/dsa-2026-193-security-update-for-dell-automation-platform-multiple-vulnerabilities). This is the primary and recommended remediation. If immediate patching is not feasible, implement compensating controls: restrict Dell Automation Platform access to trusted networks only via firewall rules or VPN requirements (reduces remote attack surface but does not eliminate insider threat), enforce strict account provisioning to minimize low-privileged account population (reduces potential attacker pool), enable comprehensive audit logging for all privilege elevation attempts and review logs for anomalous access patterns (detection not prevention), and implement network segmentation to isolate the platform from critical infrastructure it manages (limits post-exploitation lateral movement). Note these workarounds do not address the root vulnerability and should be considered temporary measures only. Organizations should prioritize the vendor patch given the platform's infrastructure management role.