EUVD-2026-75566
GHSA-94cm-x3qr-35xh
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Vendor description explicitly states arbitrary code execution; RCE implies C:H/I:H/A:H; AV:L and PR:H reflect local high-privilege requirement per description and vendor vector.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
AnalysisAI
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires high-privilege local access to the ThinOS 10 endpoint - the attacker must already hold administrative or equivalent rights on the device (CVSS PR:H, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.4 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) presents a significant internal inconsistency: it records only a Confidentiality impact (C:H) with no Integrity or Availability impact, yet the description explicitly states the outcome is arbitrary code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell ThinOS 10 to build version 2605_10.2616 or later, as specified in Dell advisory DSA-2026-389 (https://www.dell.com/support/kbdoc/en-us/000502746/dsa-2026-389-security-update-for-dell-thinos-10-for-multiple-vulnerabilities); the patch is vendor-confirmed as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to in
Analysis complete. Summary of what I produced and flagged: **CVE-2026-81048 — Dell ThinOS 10 command injection (CWE-77)
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker
OS command injection in Dell ThinOS 10 (all builds prior to 2605_10.2616) lets a high-privileged remote attacker execute
Improper access control in Dell ThinOS 10 (all versions prior to 2605_10.2518) enables a local low-privileged user to by
Local privilege escalation in Dell ThinOS 10 versions prior to ThinOS10 2602_10.0765 allows a low-privileged user with l
Unauthorized access in Dell ThinOS 10 (versions prior to 2605_10.2100) stems from an obsolete UI feature (CWE-448) that
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated atta
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version N
Physical access to Dell ThinOS 10 endpoints running versions prior to ThinOS10 2602_10.0765 allows an unauthenticated at
Protection mechanism failure in Dell ThinOS 10 (versions prior to 2605_10.2100) allows an unauthenticated attacker with
Same weakness CWE-353 – Missing Support for Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today