Dell ThinOS CVE-2026-56087

Physical possession of a Dell ThinOS 10 device running a version prior to 2605_10.2100 is the sole required condition, as confirmed by the CVSS AV:P vector. No network connectivity, authentication credentials, or prior account access on the device is required (PR:N). No user interaction is needed (UI:N). Remote exploitation is architecturally impossible given the Physical attack vector. The vulnerability does not affect devices already upgraded to version 2605_10.2100 or later. Exploitation is further limited in environments with robust physical security - locked server rooms, cable-locked endpoints, or mandatory device check-in/check-out procedures - as these controls deny the physical access prerequisite.

The CVSS base score of 6.1 (Medium) is driven primarily by the Physical attack vector (AV:P), which meaningfully constrains the exploitable population to scenarios involving physical device access - theft, unattended endpoints, supply chain interception, or insider physical access. The C:H/I:H impact metrics indicate that once physical access is achieved, the attacker can both read and modify encrypted data, representing a full data compromise of the device. AC:L indicates the bypass requires no unusual preconditions beyond device possession, and PR:N confirms no prior credentials are needed. No EPSS score was provided in the source data, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed widespread active exploitation at this time. Real-world risk is elevated in sectors where thin clients are deployed in public-facing or remote locations - healthcare kiosks, branch office deployments, shared workstations - where devices can be left unattended or physically stolen. This is a genuine priority for organizations with large thin client fleets in such environments, despite the moderate overall CVSS score.

An attacker physically obtains a Dell ThinOS 10 device - through theft, unattended access at a healthcare kiosk, or interception during shipping - and exploits the protection mechanism failure to bypass disk encryption or data access controls without any credentials. The low complexity (AC:L) and no required privileges (PR:N) suggest the bypass is achievable through a straightforward procedure (e.g., boot manipulation or direct hardware interface), yielding access to all protected data on the device. No public exploit code is known at time of analysis.