EUVD-2026-80868Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Attacker already holds high local privilege (PR:H, AV:L) and must win a link-following race (AC:H); impact is limited filesystem tampering (I:L/A:L) with no confirmed confidentiality loss (C:N).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
AnalysisAI
Improper link resolution in the Dell Update Package (DUP) Framework before 26.07.03 allows an attacker who already holds high local privileges on a host to point framework file operations at a location of their choosing, resulting in unauthorized filesystem access with limited integrity and availability impact (CVSS 3.1 base score 3.0, AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L). Because exploitation demands pre-existing high privilege, local access, the ability to plant a symbolic link in a path the framework touches, and a successful link-resolution race, this is a low-severity, hard-to-reach issue that cannot be triggered remotely or by an unprivileged user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess HIGH privileges (PR:H) and LOCAL access (AV:L) on a host running the Dell Update Package (DUP) Framework prior to version 26.07.03, plus the ability to place a symbolic link at a location the framework accesses and to win a link-resolution race (AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue and the signals are internally consistent for once. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Dell Update Package (DUP) Framework to 26.07.03 or later, as documented in Dell advisory DSA-2026-417 (https://www.dell.com/support/kbdoc/en-us/000509455/dsa-2026-417-security-update-for-dell-update-package-dup-framework-vulnerabilities); note that fleet-deployment or imaging workflows must also be refreshed so they do not reinstall a pre-26.07.03 framework. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Update Package Framework
View allDell Update Package Framework versions 23.12.00 through 24.12.00 suffers from improper privilege handling that allows lo
Local privilege escalation in Dell Update Package (DUP) Framework versions prior to 26.07.03 lets a low-privileged local
Local privilege escalation in the Dell Update Package (DUP) Framework (versions prior to 26.07.03) allows an attacker wh
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versi
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows
A link-following (symlink) defect in the Dell Update Package (DUP) Framework before version 26.07.03 allows a locally au
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. Rated
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today