What is the CVSS score of CVE-2026-40715?

CVE-2026-40715 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell ThinOS 10 are affected by CVE-2026-40715?

A local privilege escalation vulnerability in Dell ThinOS 10 (CVE-2026-40715, CVSS 7.8) allows low-privileged users to gain administrative access on affected thin clients, directly compromising…. A patch is available.

How to fix or mitigate CVE-2026-40715?

Within 24 hours: Inventory all Dell thin clients running ThinOS 10 versions prior to 2602_10.0765; restrict local and physical console access to authorized administrators only; disable or remove non-essential local user accounts on affected systems. Within 7 days: Deploy privileged activity logging on affected devices; notify affected business units of risk status and interim controls; establish contact with Dell support. Within 30 days: Confirm patch availability from Dell for version 2602_10.0765 or later; test and deploy patches to all affected systems; implement endpoint detection and response (EDR) monitoring for privilege escalation attempts on remaining unpatched systems.

Dell ThinOS 10 CVE-2026-40715

EUVD-2026-33979 HIGH

Improper Access Control (CWE-284)

2026-06-02 dell

GHSA-54h6-7v4f-8wp6

Authentication Bypass Privilege Escalation Dell Thinos 10

7.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 19:01 EUVD

Analysis Generated

Jun 02, 2026 - 17:31 vuln.today

DescriptionCVE.org

Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

AnalysisAI

Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with local access to elevate to higher privileges due to improper access control (CWE-284). The CVSS 3.1 base score of 7.8 reflects high impact on confidentiality, integrity, and availability, though exploitation requires existing local foothold. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Dell ThinOS is a closed, purpose-built thin client operating system deployed on Dell/Wyse endpoints used primarily for VDI access to Citrix, VMware Horizon, and Microsoft AVD environments. The CPE 'cpe:2.3:a:dell:thinos_10:*' identifies ThinOS 10 specifically (a Linux-based rewrite distinct from legacy ThinOS 9.x and earlier). CWE-284 (Improper Access Control) indicates the underlying defect is a missing or incorrect authorization check on a resource, action, or privileged interface - typical examples on thin client platforms include exposed local IPC endpoints, configuration utilities, or service binaries that fail to validate caller privilege before performing privileged operations. Dell's tagging of this issue as both 'Authentication Bypass' and 'Privilege Escalation' suggests an authorization decision is being bypassed to reach functionality intended only for administrators or the system itself.

RemediationAI

Vendor-released patch: ThinOS10 2602_10.0765 - upgrade affected endpoints to this build or later via Wyse Management Suite (WMS) or Dell's standard ThinOS image deployment workflow, per Dell advisory DSA-2026-214 (https://www.dell.com/support/kbdoc/en-us/000463678/dsa-2026-214). Until devices are updated, compensating controls should focus on the AV:L/PR:L precondition: restrict interactive local access by enforcing kiosk/locked-down ThinOS profiles in WMS, disabling local shell/admin mode and the local Admin Policy Tool where operationally feasible, and ensuring strong device-admin and user passwords so an attacker cannot trivially obtain the 'low privileged' foothold the CVE assumes. Trade-offs: locking down admin mode and the policy tool will impede on-device troubleshooting by field staff and may push more support load to centralized WMS-based remediation.