EUVD-2026-26193Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Requires a valid low-priv account (PR:L) and winning a hard-to-time race with a coincident user action (AC:H, UI:R) over the network, yielding full BMC control (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.
AnalysisAI
Privilege escalation in Dell iDRAC10 (baseboard management controller firmware) versions 1.20.70.50 and 1.30.05.10 lets an already-authenticated low-privileged user exploit a race condition against insufficiently protected credentials to obtain elevated access to the server management controller. The flaw carries a CVSS 3.1 score of 7.1 with total confidentiality, integrity, and availability impact on the affected component. There is no public exploit identified at time of analysis and EPSS rates near-term exploitation at only 0.01%, but Dell has shipped a fix.
Technical ContextAI
iDRAC (Integrated Dell Remote Access Controller) is the out-of-band baseboard management controller (BMC) embedded in Dell PowerEdge servers, providing lights-out remote administration over a dedicated network interface independent of the host OS. The root cause is CWE-522 (Insufficiently Protected Credentials) combined with a time-of-check/time-of-use race condition: credentials or authorization state are handled in a way that a concurrent, precisely timed operation can subvert, allowing a low-privileged account to cross a privilege boundary. Because the BMC governs the entire physical host (power, firmware, virtual media, console), compromise of iDRAC is effectively total control of the server. The single CPE cpe:2.3:a:dell:idrac10 confirms the affected component is the iDRAC10 firmware line specifically.
RemediationAI
Vendor-released patch: 1.30.10.50 - upgrade all Dell iDRAC10 controllers to firmware 1.30.10.50 or later per Dell DSA-2026-187 (https://www.dell.com/support/kbdoc/en-us/000452298/dsa-2026-187-security-update-for-dell-idrac10-vulnerability), which is the definitive fix. Until firmware is applied, reduce exposure with compensating controls: place all iDRAC/BMC interfaces on an isolated, firewalled management VLAN reachable only from a hardened jump host (limits the AV:N reach but does not stop an insider with valid low-priv credentials); prune and audit low-privileged iDRAC local and directory-mapped accounts and enforce least privilege so fewer accounts can attempt the race (trade-off: administrative overhead); and enable/monitor iDRAC logging and alerting for anomalous privilege changes or repeated rapid authorization attempts indicative of race exploitation (detective only, not preventive). These controls raise the bar but do not remove the vulnerability - firmware upgrade remains the required remediation.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today