EUVD-2026-75573
GHSA-7pgg-3gfw-qgx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ThinOS 10 endpoint over network
-
DeliverySend crafted request to exposed service
-
ExploitTrigger protection-mechanism failure (bypass access control)
-
ExecutionExecute code in application context
-
ImpactAccess/tamper with session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only remote network access to a Dell ThinOS 10 device running a build earlier than 2605_10.2616, with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is reachability rather than configuration: ThinOS endpoints are usually deployed on internal or VDI-segmented networks, so an attacker must first be able to route traffic to the device's exposed service. Impact is scoped 'within the application context' (S:U, A:L), which bounds the outcome to the ThinOS application layer rather than guaranteed full-host takeover. |
| Impact | The CVSS 3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) reflects the worst-case combination for reachability: remote, low-complexity, no privileges, and no user interaction, with high confidentiality and integrity impact and only limited availability impact. That profile - unauthenticated network RCE against a fleet-deployed endpoint OS - means a mid-sized municipal or enterprise IT team should treat it as urgent regardless of whether a public PoC exists yet. Counterbalancing signals: there is no EPSS figure, KEV entry, or public exploit in the provided data, so exploitation probability is currently unquantified and there is no evidence of active or automated exploitation. The 'Authentication Bypass' tag overstates the mechanism (the CWE and description point to a protection-mechanism/access-control failure, not credential bypass), and the A:L rating plus 'within the application context' wording suggests execution is sandboxed to the ThinOS application layer rather than granting full device takeover - verify blast radius against Dell's advisory before assuming host compromise. |
| Exploit ScenarioDerived | An attacker with network reachability to a ThinOS 10 endpoint sends crafted traffic that triggers the protection-mechanism failure, bypassing the intended access control and executing attacker-supplied code within the ThinOS application context - no credentials or user interaction needed. From that foothold the attacker could tamper with the session-brokering environment or harvest data the application handles. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker to run code within the application context of the affected thin client, per Dell advisory DSA-2026-389. The root cause is a protection mechanism failure (CWE-284) that bypasses an intended security control rather than exploiting a memory-corruption bug directly. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the network-reachable, no-authentication attack profile makes it high priority.
RemediationAI
Vendor-released patch: upgrade Dell ThinOS 10 to build 2605_10.2616 or later, which remediates this issue per Dell advisory DSA-2026-389 (https://www.dell.com/support/kbdoc/en-us/000502746/dsa-2026-389-security-update-for-dell-thinos-10-for-multiple-vulnerabilities). Because ThinOS fleets are typically managed centrally, push the update via Dell Wyse Management Suite to all enrolled devices and confirm build numbers post-deployment. As interim compensating controls until patching completes, restrict network reachability of ThinOS endpoints - place thin clients on a segmented VLAN, block inbound connections from untrusted networks, and permit only the management server and required VDI brokers to initiate sessions to the devices; the trade-off is that overly tight filtering can disrupt management-suite check-ins or session brokering, so validate the allowlist against your VDI traffic before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell ThinOS is a proprietary, locked-down thin-client operating system that runs on Dell/Wyse endpoints and is purpose-built to broker VDI/DaaS sessions (Citrix, VMware Horizon, Azure Virtual Desktop) with minimal local attack surface. The affected component is identified by CPE cpe:2.3:a:dell:thinos_10 covering ThinOS 10 builds before 2605_10.2616. The weakness class is CWE-284 (Improper Access Control), described by Dell as a 'Protection Mechanism Failure' - an intended safeguard fails to enforce, letting an unauthenticated remote party reach functionality that should be gated, which in turn yields code execution scoped to the application context rather than full underlying-OS compromise (consistent with the CVSS A:L / scope-unchanged rating).
Know when Thinos 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Unauthenticated remote code execution with no user interaction gives AV:N/AC:L/PR:N/UI:N; C:H/I:H from code exec, A:L and S:U since impact stays within the application context.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.
Executive ViewAI
Dell ThinOS 10 thin clients are vulnerable to remote code execution attacks from unauthenticated network users, enabling attackers to compromise endpoints without authentication. Organizations deploying Dell thin clients face immediate risk of endpoint infection and lateral network movement. Leadership should prioritize patching to prevent unauthorized access to these gateway devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who alre
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.276
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Authenticated remote command execution in Dell ThinOS 10 (builds prior to 2605_10.2616) allows an attacker who already h
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated atta
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (C
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version N
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with
Exploit-DB