Dell ThinOS CVE-2026-40713

Physical access to the target Dell ThinOS 10 device is required (CVSS AV:P) - this is a hard prerequisite that cannot be bypassed remotely. The attacker requires no prior authentication (PR:N per CVSS vector) and no user interaction is needed (UI:N). No non-default configuration or network connectivity is specified as a prerequisite. The primary and decisive limiting factor is mandatory physical proximity: remote, adjacent-network, or internet-based exploitation is categorically excluded by the AV:P vector. Exploitation is further constrained to devices running ThinOS 10 versions prior to 2602_10.0765 on the specific Dell thin client hardware platform.

The CVSS base score of 6.1 (Medium) reflects a balance between high confidentiality and integrity impacts (C:H/I:H) and the stringent physical access vector (AV:P), which is the dominant risk-reducing factor. No EPSS score was provided in source data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified at time of analysis - both signals consistent with no observed widespread exploitation. Real-world risk is concentrated in environments where thin clients are deployed in physically accessible locations: shared open-plan offices, kiosks, branch offices, or healthcare reception areas. Organizations with strong physical security posture face substantially reduced realistic risk despite the medium CVSS score. The C:H/I:H scoring is notable - if exploited, the attacker can both read and modify sensitive state, which could facilitate credential harvesting or configuration tampering in a VDI context.

An attacker with physical access to an unattended Dell ThinOS 10 thin client - such as at a kiosk, shared workstation, or unmonitored branch office desk - interacts directly with the device without supplying any credentials, leveraging the improper access control flaw to read sensitive session data, cached credentials, or configuration information. Given AC:L and PR:N in the CVSS vector, the technique is expected to require minimal specialized skill once physical access is achieved. No public POC has been identified at time of analysis.