Dell Command | Monitor CVE-2026-49811

Exploitation requires local access with an already-authenticated low-privileged account on a Windows host running Dell Command | Monitor (DCM) at a version prior to 10.13.2; there is no remote or unauthenticated path (AV:L, PR:L). The specific enabling condition is Dell's incorrect permission assignment (weak ACL) on a critical DCM resource, allowing a standard user to modify or control a resource that DCM uses at elevated privilege. Limiting factors: attacker must first obtain a foothold on the endpoint, DCM must be installed and running, and only versions below the 10.13.2 fix are affected; no user interaction is needed once the foothold exists.

This is a credible but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) confirms a local, low-complexity elevation-of-privilege flaw requiring an already-authenticated low-privileged account - it is NOT remotely exploitable, which caps its real-world urgency despite the 8.4 High score. The 8.4 is inflated by the scope change (S:C) combined with C:H/I:H, consistent with a low-privileged user gaining SYSTEM/administrative control on the host. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatable mass-exploitation; this reads as a targeted local-privilege-escalation issue rather than a widespread threat. One data note: the vendor tags label this 'Information Disclosure,' but both the description (Elevation of Privileges) and the vector (I:H, not I:N) indicate a privilege-escalation/integrity impact - the tag appears mislabeled. Overall: patch during normal cycles on managed Dell fleets; it is a real local EoP but requires an attacker to already have a foothold.

An attacker who already has a standard (low-privileged) local account on a Dell Windows endpoint running DCM abuses weak ACLs on a critical DCM resource (e.g., a file, registry key, or service configuration) to modify or hijack a component executed at higher privilege, gaining SYSTEM-level code execution. Because the vector is local with low attack complexity (AV:L/AC:L) and no user interaction, exploitation is straightforward once a foothold exists. No public exploit code was identified at time of analysis.