EUVD-2026-44744
GHSA-f966-26qc-phpg
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that a low-privileged local attacker can abuse to bypass authentication controls. With valid low-level local access to the thin-client, an attacker can leverage the leftover interface path to reach functionality or data they should not have, yielding high confidentiality, integrity, and availability impact per the CVSS 7.8 (High) rating. No public exploit identified at time of analysis; the flaw was reported by Dell and disclosed in advisory DSA-2026-300.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Thinos 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Executive ViewAI
Organizations using Dell ThinOS 10 thin-client endpoints (versions before 2605_10.2100) are exposed to unauthorized access through a dormant user interface component that allows local attackers to circumvent authentication safeguards. This creates a direct threat to data protection, system change management, and operational continuity across the thin-client infrastructure, with no vendor patch currently available to remediate the risk.
Within 24 hours, conduct a complete asset inventory of all Dell ThinOS 10 systems, identify those running versions prior to 2605_10.2100, and review access controls for low-privileged local users on these devices. Within 7 days, implement compensating controls by disabling or restricting access to the legacy UI pathway where technically feasible, strengthening local authentication policies, and segregating vulnerable systems on a dedicated network segment. Within 30 days, monitor Dell's advisory DSA-2026-300 for patch availability and develop a phased upgrade strategy to version 2605_10.2100 or later across the entire affected thin-client estate.
No vendor-released patch identified at time of analysis. Implement interim mitigations: disable or restrict access to the legacy UI feature if supported by your ThinOS deployment; restrict low-privileged user access to affected systems through access control policies; isolate vulnerable thin-clients on a dedicated network segment; monitor Dell advisory DSA-2026-300 for patch release and maintain readiness for immediate patching upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker
Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who alre
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.276
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 l
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Authenticated remote command execution in Dell ThinOS 10 (builds prior to 2605_10.2616) allows an attacker who already h
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated atta
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (C
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version N
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated at
Exploit-DB