Dell DDPM CVE-2026-59917

Exploitation requires a low-privileged local Windows user account on a system where Dell DDPM is installed and running a version prior to 2.3.0.17. The CVSS vector AV:L/PR:L confirms local system access and at minimum a standard (non-administrative) user account are necessary - remote network-based exploitation is not possible with this vulnerability. No interaction from a higher-privileged user is required (UI:N), making this a fully self-contained local escalation. Key limiting factors: the attacker must already have local logon access to the target system (physical, RDP, or via prior compromise), and DDPM must be installed and active. Systems without DDPM, or systems upgraded to version 2.3.0.17 or later, are not affected. This positions the vulnerability primarily as a post-initial-access privilege escalation tool or an insider threat vector, not a direct internet-facing attack surface.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, reflecting that exploitation is local, requires only a low-privileged account, has low complexity, and yields full confidentiality, integrity, and availability impact on the host. The scope is unchanged (S:U), meaning the blast radius is contained to the vulnerable system itself rather than cascading to adjacent systems directly. The low attack complexity and lack of required user interaction are meaningful amplifiers: any standard Windows user account on an affected machine can attempt exploitation without needing to social-engineer a privileged user. However, the strictly local attack vector (AV:L) means this is a post-initial-access or insider threat scenario, not a remote internet-facing risk. No EPSS score was provided, and neither KEV listing nor public POC has been identified, which tempers urgency slightly. The RCE and Authentication Bypass tags raise the practical severity, suggesting the technique may be straightforward once local access is obtained. Overall, this is a genuine priority for enterprise environments with DDPM deployed, particularly where shared or multi-user Windows endpoints are common.

A standard Windows user account on a corporate workstation or shared system running Dell DDPM prior to 2.3.0.17 abuses the improper access control flaw - potentially via a misconfigured privileged service endpoint, named pipe, or COM object exposed by DDPM - to bypass caller validation and elevate to SYSTEM or administrator privileges. With elevated execution, the attacker installs a backdoor, dumps credentials from LSASS, or pivots laterally within the enterprise network. No public exploit code has been identified at time of analysis, but the low attack complexity rating suggests the technique is reproducible without specialized tooling.