Dell iDRAC CVE-2026-70412

Exploitation requires a valid low-privileged iDRAC account (PR:L per CVSS), remote network access to the iDRAC management interface (AV:N), and some form of user interaction (UI:R) - the specific interaction is not detailed in available public data but likely involves navigating to or invoking a particular iDRAC UI page or API endpoint that triggers a read of an insufficiently erased memory region. The PR:L gate limits exploitation to insiders, compromised service accounts, or attackers who have separately obtained iDRAC credentials through another means. The UI:R gate prevents fully automated or unauthenticated exploitation. Impact is strictly limited to limited confidentiality disclosure (C:L); no write or denial-of-service capability is associated. Default deployments that isolate the iDRAC interface on a dedicated out-of-band management network further restrict the reachable attacker population.

The CVSS 3.5 Low score is internally consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), but gated behind low-privilege authentication (PR:L) and a required user interaction step (UI:R), with only limited confidentiality impact and no integrity or availability consequence. The UI:R constraint meaningfully degrades automatable exploitability - an attacker cannot fully script or mass-scan exploit this without triggering an authenticated user-side event. No EPSS data was included in the provided intelligence, and neither CISA KEV listing nor public POC availability is indicated, both of which further support a lower-urgency posture. Under an SSVC framework, this would likely score 'defer' for most organizations given low technical impact and compound exploitation prerequisites. Even a mid-sized municipal IT team in rybnik managing a Dell server fleet would reasonably deprioritize this behind actively exploited vulnerabilities, scheduling it within a standard patching cycle rather than emergency remediation. The main realistic amplifier is iDRAC exposure on insufficiently segmented networks - environments where the management interface is reachable from general user or application VLANs face a higher effective attack surface than those enforcing out-of-band management isolation.

An attacker holding a valid low-privilege iDRAC account navigates to or triggers a specific iDRAC interface function that reads from an improperly erased memory region, retrieving residual data from a prior operation - potentially including fragments of earlier sessions, configuration values, or other sensitive controller state. The user interaction requirement suggests exploitation may be tied to a specific UI workflow or API call rather than a passive read. No public proof-of-concept code has been identified at time of analysis.