Dell Application Store CVE-2026-82166

Exploitation requires the attacker to have adjacent (same logical network segment / Layer 2 broadcast domain - e.g. shared LAN or Wi-Fi) access to a host running Dell Application Store at a version prior to 26.05.0.7; the vulnerability is a missing authentication check (CWE-306) on a critical function, so no credentials and no user interaction are needed once that network position is obtained. The primary limiting factor is the Adjacent attack vector (AV:A): the flaw is not exploitable over routed/internet paths, so an attacker must already be on or have compromised a device on the same local network, which excludes remote internet-based mass exploitation.

This is a credible priority for environments running Dell Application Store, though its reach is bounded by the adjacency requirement. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N) describes a low-complexity, unauthenticated path to arbitrary code execution with high confidentiality, integrity, and availability impact (C:H/I:H/A:H), which aligns well with CWE-306 (Missing Authentication for Critical Function) - an exposed critical function reachable without credentials. The decisive mitigating signal is the Adjacent (AV:A) attack vector: exploitation is not routable from the internet and requires the attacker to already be on the same logical network segment (LAN/Wi-Fi/broadcast domain), which meaningfully narrows the realistic threat to insiders, compromised adjacent hosts, or shared-network scenarios rather than mass internet scanning. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no evidence of active exploitation or weaponization; the 8.8 score reflects severe potential impact, not demonstrated exploitation. EPSS and KEV data are absent (not confirmed negative), so exploitation probability cannot be quantified from this data set. Net: treat as a high-severity patch-soon item on networks where Dell Application Store is reachable by untrusted adjacent hosts, but it is not an internet-facing emergency on the current evidence.

An attacker positioned on the same local network as a device running a vulnerable Dell Application Store (prior to 26.05.0.7) - for example on a shared corporate LAN or Wi-Fi - sends requests directly to a critical function that lacks authentication checks, obtaining arbitrary code execution on the host without any credentials or user interaction. No public exploit code was identified in the provided data, so this scenario is based on the CVSS vector and CWE-306 classification rather than a demonstrated PoC.