Dell ThinOS 10 CVE-2026-40715

Exploitation requires interactive local access to a Dell ThinOS 10 device running a build older than ThinOS10 2602_10.0765, plus an existing low-privileged authenticated session on that device (CVSS PR:L) - there is no remote network vector (AV:L) and no user interaction by a second party is needed (UI:N). Limiting factors that reduce realistic risk: the attacker must already be able to reach the local ThinOS UI or local interfaces (physically present at a kiosk, or via a remote console mechanism that exposes the local session), the device must not yet be upgraded to 2602_10.0765, and the exploit appears specific to ThinOS 10 - ThinOS 9.x and other thin client OSes are not listed as affected. The exact ThinOS feature or component that performs the deficient access-control check is not disclosed in the supplied Dell advisory excerpt and would need to be confirmed from DSA-2026-214.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: an already-authenticated low-privileged local user can reliably escalate without user interaction, yielding full CIA impact within the same security scope. There is no EPSS score provided in the input, no CISA KEV listing, and no POC reference, so on widely-used prioritization signals this is not a 'drop everything' issue. However, the real-world risk on thin clients is non-trivial because these endpoints frequently sit in shared kiosk, clinical, retail, or call-center environments where physical or interactive local access by lightly-trusted users is the norm - exactly the threat model AV:L/PR:L describes. The signal set is partially incomplete: no EPSS, no public technical write-up, and Dell's advisory page is not parsed in this input, so the precise privileged component cannot be verified from the supplied data.

An attacker who has obtained an ordinary user session on a ThinOS 10 thin client - for example a shared clinical workstation, retail back-office terminal, or an insider with standard kiosk credentials - invokes the vulnerable local interface that fails to enforce proper authorization and elevates to an administrative/system context on the device. With elevated rights they can alter ThinOS configuration, harvest cached VDI broker or credential material, or pivot the endpoint into a persistent foothold inside the VDI environment. No public exploit code is identified in the supplied references, so initial exploitation would currently require independent vulnerability research or details disclosed in DSA-2026-214.