EUVD-2026-41117
GHSA-wwmx-3p39-rx9c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local link-following LPE needing an existing low-priv session (AV:L, PR:L), no user interaction and low complexity, yielding total host compromise (C:H/I:H/A:H).
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Local privilege escalation in Dell Device Management Agent (DDMA) versions prior to 26.05 allows an already-authenticated, low-privileged user on the host to elevate to full system-level control by abusing insecure symbolic/hard link resolution (CWE-59) during file operations. Dell has released a fix in DDMA 26.05. There is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.12% (3rd percentile), but the SSVC technical impact is rated 'total', reflecting the complete compromise achievable once a foothold exists.
Technical ContextAI
Dell Device Management Agent is an endpoint management/telemetry agent that runs with elevated (typically SYSTEM/root) privileges to manage and monitor Dell client devices. The root cause is CWE-59, Improper Link Resolution Before File Access ('Link Following'): a privileged process operation follows an attacker-controlled symbolic link, junction, or hard link instead of the intended file, so a low-privileged user can redirect a trusted file read/write to a location they should not control. This is a classic TOCTOU-style link-following flaw in which the agent fails to canonicalize or verify a path before opening it, letting an unprivileged actor coerce the high-privilege agent into writing to, overwriting, or acting on a target of the attacker's choosing. The single affected CPE is cpe:2.3:a:dell:device_management_agent, confirming the agent software itself - not a broader Dell platform - is the vulnerable component.
RemediationAI
Vendor-released patch: DDMA 26.05 - upgrade Dell Device Management Agent to version 26.05 or later on all managed endpoints per Dell advisory DSA-2026-258 (https://www.dell.com/support/kbdoc/en-us/000473690/dsa-2026-258), which is the primary and recommended fix. Because exploitation requires an existing local low-privileged session, effective interim compensating controls until patching completes include restricting interactive and local logon rights on hosts running DDMA to trusted administrators only (reduces the pool of accounts that can stage the link), enforcing strong endpoint EDR/monitoring for symlink/junction creation and unexpected file writes in the agent's working and privileged directories, and tightening filesystem ACLs on the directories the agent reads/writes so unprivileged users cannot create links there (trade-off: overly strict ACLs may break agent self-update or logging, so validate agent function after changes). Where feasible, prioritize patching multi-user and shared workstations first, since single-user admin-only endpoints present less opportunity for a low-privileged foothold.
More in Device Management Agent
View allDell Device Management Agent versions before 26.02 suffer from an authorization bypass that allows local attackers with
Dell Device Management Agent versions before 26.02 store passwords in plaintext, allowing high-privileged local attacker
Device Management Agent versions up to 26.02 is affected by improper check for unusual or exceptional conditions (CVSS 3
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today