Dell iDRAC Service Module CVE-2026-81472

Exploitation requires the attacker to already possess high-privileged local access (administrator on Windows, root/elevated on Linux or ESXi) on a host running Dell iDRAC Service Module at a version below 6.1.1.0. There is no network path and no default-configuration remote trigger - the flaw cannot be reached without prior local, privileged foothold, which substantially limits realistic risk to post-compromise scenarios on managed Dell PowerEdge servers.

This is a low-to-moderate real-world priority despite being a code-injection (CWE-94) flaw. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, base 4.2) is the dominant signal and it is internally consistent with the description: AV:L confirms local-only access and PR:H confirms the attacker must already hold high privileges on the host, so this is a privilege-boundary escalation rather than a remote compromise. There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so there is no evidence of active or probable exploitation - no public exploit identified at time of analysis. The only decision signal elevating it is the vuln.today 'this_month' label, which is a routine-patch cadence, not act_now or emergency. The impact is uniformly Low across C/I/A and scope is unchanged (S:U), so even successful exploitation yields limited elevation. Note the tag set includes 'RCE', which conflicts with the AV:L local, high-privilege-required reality of this CVE - this reads as a local elevation-of-privilege issue, not remote code execution; treat the RCE label with skepticism.

An attacker who has already obtained high-privileged (administrator/root) local access to a Dell PowerEdge host running the iDRAC Service Module prior to 6.1.1.0 injects attacker-controlled code that the service module generates or executes, gaining elevated privileges on the host. Because CVSS specifies AV:L and PR:H, this is a post-compromise local escalation step, not an initial-access vector. No public exploit code is identified in the available data.