EUVD-2026-80862Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local low-privileged foothold (AV:L/PR:L) with a required DUP execution by another actor (UI:R); command injection into the elevated framework yields full host compromise (C:H/I:H/A:H).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
AnalysisAI
Local privilege escalation in the Dell Update Package (DUP) Framework (versions prior to 26.07.03) allows an attacker who already holds low-privileged access on a host to inject operating system commands that execute in the elevated context of the update framework, resulting in high impact to confidentiality, integrity and availability. Exploitation also requires user interaction - a trusted user or an automated process must actually run a Dell Update Package - as reflected in the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.3 High), which is local-only and carries no network vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already have local, low-privileged access to a system where the Dell Update Package (DUP) Framework prior to 26.07.03 is installed, plus user interaction (UI:R) - a trusted user or automated process must execute a Dell Update Package so the injected OS command runs in the framework's elevated context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H = 7.3 High) describes a locally-exploitable elevation-of-privilege flaw: an attacker needs existing low-privileged code execution on the host (AV:L, PR:L) plus a trusted user or automated process to run a Dell Update Package (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading the Dell Update Package (DUP) Framework to 26.07.03 or later, as documented in Dell Security Advisory DSA-2026-417 (https://www.dell.com/support/kbdoc/en-us/000509455/dsa-2026-417-security-update-for-dell-update-package-dup-framework-vulnerabilities); vendor-released patch: 26.07.03. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Dell endpoint running DUP Framework versions prior to 26.07.03 and reconcile the conflicting patch-status metadata in your tracking system - the vendor advisory DSA-2026-417 states a fixed release exists, so treat version 26.07.03 as the authoritative remediation target while confirming availability for each affected platform. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Update Package Framework
View allDell Update Package Framework versions 23.12.00 through 24.12.00 suffers from improper privilege handling that allows lo
Local privilege escalation in Dell Update Package (DUP) Framework versions prior to 26.07.03 lets a low-privileged local
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versi
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows
A link-following (symlink) defect in the Dell Update Package (DUP) Framework before version 26.07.03 allows a locally au
Improper link resolution in the Dell Update Package (DUP) Framework before 26.07.03 allows an attacker who already holds
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. Rated
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today