What is the CVSS score of CVE-2026-40713?

CVE-2026-40713 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40713?

Yes, a patch is available for CVE-2026-40713. Update the affected software to the latest version immediately.

Dell ThinOS CVE-2026-40713

EUVD-2026-33977 MEDIUM

Improper Access Control (CWE-284)

2026-06-02 dell

GHSA-972f-c53g-w92c

Dell Information Disclosure Authentication Bypass Thinos 10

6.1

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.1 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 02, 2026 - 19:01 EUVD

Analysis Generated

Jun 02, 2026 - 17:34 vuln.today

DescriptionCVE.org

Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access control vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information exposure.

AnalysisAI

Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated attacker to bypass access controls, exposing sensitive information with high confidentiality and integrity impact. The flaw, rooted in CWE-284 (Improper Access Control), enables circumvention of authentication or authorization mechanisms at the device level without requiring prior credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit has been identified; Dell has released a patched build addressing this issue.

Technical ContextAI

Dell ThinOS is a purpose-built, locked-down operating system for thin client endpoints used in VDI and desktop virtualization deployments. The affected CPE (cpe:2.3:a:dell:thinos_10) covers all ThinOS 10 builds prior to 2602_10.0765. CWE-284 (Improper Access Control) indicates the system fails to adequately enforce access restrictions on resources or functionality - in this case, a physically present attacker can interact with the device in a manner that bypasses intended controls without supplying credentials. The CVSS vector AV:P confirms physical proximity is mandatory, while AC:L and PR:N indicate the attack requires neither special configuration knowledge nor prior authentication. The C:H and I:H impact components suggest both sensitive data readability and potential modification of system state are in scope, while A:N indicates availability is unaffected.

RemediationAI

Upgrade Dell ThinOS 10 to version ThinOS10 2602_10.0765 or later, as specified in Dell's advisory DSA-2026-214 at https://www.dell.com/support/kbdoc/en-us/000463678/dsa-2026-214. Where immediate patching is not feasible, compensating controls must focus on physical security: deploy thin client devices in locked enclosures or restricted rooms, apply chassis cable locks to prevent device removal or port access, and enforce BIOS/firmware passwords to block unauthorized boot sequences. Additionally, restricting physical port access (USB, serial) via endpoint configuration can reduce the attack surface accessible to a walk-up attacker. These physical controls do not remediate the underlying access control flaw and carry the trade-off of operational friction for legitimate users - they should be treated as temporary mitigations pending patch deployment.