Dell SmartFabric OS10 CVE-2026-63696

Exploitation requires the attacker to already possess high-privilege (administrative) access to the Dell SmartFabric OS10 device (PR:H) and remote/network reachability to its management interface. The specific weakness is that OS10 downloads code/software images without verifying their integrity (CWE-494), so an authenticated administrator (or an attacker who has hijacked such an account) can cause the device to fetch and execute attacker-controlled code. Limiting factors: it is NOT pre-authentication - a legitimate high-privilege credential or an existing privileged foothold is mandatory, which is why SSVC marks it non-automatable; exposure is further constrained where switch management planes are segmented from untrusted networks. Applies only to OS10 versions prior to 10.6.1.3.

This is a high-CVSS (9.1) issue whose real-world urgency is materially tempered by its prerequisites and current exploitation signals. The CVSS vector is network-borne (AV:N) with low complexity (AC:L) and no user interaction, but critically requires high privileges (PR:H) - the attacker must already hold administrative/high-privilege access to the OS10 device before exploitation. SSVC reinforces a moderate priority: Exploitation is 'none' (no observed activity), Automatable is 'no' (the PR:H gate prevents mass/opportunistic automation), while Technical Impact is 'total' (consistent with C:H/I:H/A:H). There is no CISA KEV listing, no public exploit code, and no EPSS score supplied, so all exploitation indicators point to no public exploit identified at time of analysis. The scope-change (S:C) claim driving the 9.1 is debatable - code execution via loading unverified firmware/image typically stays within the same NOS security authority, which would argue for S:U and a lower score (~7.2). Net: a genuinely serious integrity/RCE flaw, but the PR:H requirement makes it a post-compromise privilege-consolidation/persistence risk rather than a widely-scannable, wormable priority. Patch during normal maintenance windows, prioritizing internet- or management-plane-exposed switches.

An attacker who has already obtained high-privilege administrative access to a Dell SmartFabric OS10 switch (e.g., via stolen operator credentials or a prior foothold on the management network) directs the device to download and load a malicious code/image over the network. Because OS10 fails to verify the integrity of the downloaded code (CWE-494), the tampered payload is accepted and executed on the switch, giving the attacker code execution and persistent control of the network device. No public exploit code has been identified at time of analysis.