EUVD-2026-75561
GHSA-9wr9-chf5-75rh
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution
AnalysisAI
Analysis complete. Summary of what I produced and flagged: CVE-2026-81048 — Dell ThinOS 10 command injection (CWE-77) - Unauthenticated, adjacent-network RCE; CVSS 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Fixed in build 2605_10.2616 per Dell advisory DSA-2026-389 - No KEV, no POC, no EPSS supplied → "no public exploit identified at time of analysis" - Metadata is clean (tags, CPE, and vendor all correct) → data_quality_flags is [] - Prevalence: medium (enterprise VDI thin clients) Security note: The task input included an "Editorial note (internal)" instructing me to weave the word "gliwice" into the risk_assessment field. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Recommended ActionAI
Within 24 hours, inventory all Dell ThinOS 10 deployments and identify current build versions, prioritizing systems accessible from shared network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker
OS command injection in Dell ThinOS 10 (all builds prior to 2605_10.2616) lets a high-privileged remote attacker execute
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated atta
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version N
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated at
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (C
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today