What is the CVSS score of CVE-2026-41119?

CVE-2026-41119 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41119?

Yes, a patch is available for CVE-2026-41119. Update the affected software to the latest version immediately.

Dell Live Optics CVE-2026-41119

EUVD-2026-30763 MEDIUM

Improper Certificate Validation (CWE-295)

2026-05-18 dell

GHSA-58g4-m6h8-h97x

Information Disclosure Dell Microsoft

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 11:30 vuln.today

Patch available

May 18, 2026 - 11:01 EUVD

DescriptionCVE.org

Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.

AnalysisAI

Improper SSL/TLS certificate validation in Dell Live Optics Windows and Personal Edition collectors allows remote attackers to intercept and modify data transmitted by the collector. The vulnerability requires network positioning (man-in-the-middle) and user interaction, making exploitation moderately complex but enabling complete compromise of data confidentiality and integrity for collector communications. Dell has released patches in version 27.1.10.1 to address the certificate validation flaw.

Technical ContextAI

This vulnerability affects Dell Live Optics data collection agents for Windows and Personal Edition deployments. The flaw stems from CWE-295 (Improper Certificate Validation), where the collector fails to properly validate SSL/TLS certificates when establishing encrypted connections. This allows an attacker positioned on the network path to present fraudulent certificates that the collector will accept, enabling man-in-the-middle attacks. The affected CPE indicates the vulnerability exists across the Dell Live Optics product line prior to the patched release. Live Optics collectors are typically deployed in enterprise environments to gather infrastructure performance and capacity data, making them sensitive components that handle potentially privileged system information.

RemediationAI

Upgrade Dell Live Optics Windows and Personal Edition collectors to version 27.1.10.1 or later, which implements proper SSL/TLS certificate validation. Download the patched version from Dell Support following guidance in security advisory DSA-2026-221 (https://www.dell.com/support/kbdoc/en-us/000464862/dsa-2026-221-security-update-for-dell-live-optics-collector-ssl-vulnerability). If immediate patching is not feasible, restrict collector communications to trusted networks only using network segmentation or VPN tunnels to prevent man-in-the-middle positioning. Deploy network monitoring to detect certificate anomalies or unexpected certificate authorities in collector traffic. Note that network restrictions may impact collector functionality if cloud-based Live Optics services are accessed, and VPN overhead may affect performance metrics collection accuracy.