What is the CVSS score of CVE-2026-91893?

CVE-2026-91893 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-91893?

Within 24 hours, identify all Windows hosts running Dell Alienware Command Center versions prior to 6.14.54.0 and restrict local interactive access to only trusted users; within 7 days, apply the vendor-released patch (version 6.14.54.0) as specified in Dell security advisory DSA-2026-429, and if unable to patch immediately, remove or disable AWCC on non-essential systems; within 30 days, confirm remediation across all assets, verify no vulnerable versions remain, and review local account privileges and endpoint detection coverage for privilege escalation attempts.

Dell Alienware Command Center CVE-2026-91893

EUVD-2026-115549 HIGH

Improper Privilege Management (CWE-269)

2026-11-02 dell

GHSA-p6p5-9qcr-hm7w

Privilege Escalation Dell Alienware Command Center Awcc

7.8

CVSS 3.1 · Vendor: dell

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged local account on host
Exploit

Target AWCC improper privilege management flaw
Execution

Execute privilege-escalation action
Impact

Gain elevated/system privileges

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires local access to a Windows host with Dell Alienware Command Center installed at a version prior to 6.14.54.0, and the attacker must already possess a low-privileged local account (PR:L) - it is not remotely reachable (AV:L) and needs no user interaction (UI:N). Exploitation is limited to systems where this specific AWCC gaming software is deployed, typically Alienware/Dell gaming PCs; the exact feature or component abused for escalation is not described in the available sources. The limiting factors are the local-only vector and the need for a pre-existing authenticated foothold.
Impact	This is a locally-exploitable privilege escalation (CWE-269) in Dell Alienware Command Center, rated CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent: the vector confirms a local attack path (AV:L), low attack complexity (AC:L), and an already-authenticated low-privileged user (PR:L) with no user interaction, yielding full confidentiality, integrity, and availability impact after escalation. There is no CISA KEV listing and no POC or exploit reference in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - the 7.8 reflects impact severity, not demonstrated attacker activity. No EPSS score was provided, so widespread-exploitation probability cannot be quantified. SSVC-style fields (automatable, technical impact) were not supplied beyond the vendor priority label 'this_week', which signals a prompt-but-not-emergency remediation cadence. Net: this is a genuine local EoP worth patching on a near-term schedule, but it is not a drive-by or remote-mass-exploitation threat - it requires an attacker to already hold a foothold as a low-privileged local user on an affected host.
Exploit ScenarioDerived	An attacker who already has a low-privileged local account (or has landed low-privileged code via phishing or another bug) on a machine running Alienware Command Center before 6.14.54.0 abuses the improper privilege management flaw to elevate to higher/system privileges. The specific trigger mechanism is not described in the available sources. No public exploit was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Nov 02, 2026

Dell Alienware Command Center (AWCC) releases prior to 6.14.54.0 contain an improper privilege management flaw (CWE-269) that lets an attacker who already holds a low-privileged local account escalate to higher privileges, with high impact to confidentiality, integrity and availability. Exploitation requires local access to a Windows host running the affected AWCC build, and the vendor has published a security advisory (DSA-2026-429) covering multiple vulnerabilities in the 6.x line. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) despite a high CVSS base score of 7.8.

RemediationAI

Vendor-released patch: upgrade Dell Alienware Command Center to version 6.14.54.0 or later; Dell's DSA-2026-429 advisory (https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities) documents the update for the 6.x line, and systems can also be updated through the Dell support/update channels used for the machine. Because the flaw is local-only and requires a pre-existing low-privileged account, the practical interim controls are to remove or update AWCC on hosts that do not require it, and until the upgrade is applied, restrict interactive logon to affected gaming endpoints to trusted users and audit local accounts for unnecessary standard-user access, accepting that this reduces usability on shared machines rather than removing the underlying escalation path. Re-scan endpoints for AWCC versions below 6.14.54.0 after rollout to confirm coverage.

Affected VersionsENISA

Alienware Command Center (AWCC) 0 <6.14.54.0

Affected Packages

euvd alienware_command_center_awcc fix: 6.14.54.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The CWE-269 class (Improper Privilege Management) indicates that the software assigns, checks or enforces privilege levels incorrectly, allowing a process running with fewer rights to reach operations or resources meant for a higher privilege context. Here the affected component is Dell Alienware Command Center, a Windows gaming/control utility shipped with Alienware and Dell gaming systems that typically installs background services and drivers of its own and is often used from standard user sessions; a low-privileged local user interacting with such a component can obtain elevated rights on the host. The trigger mechanism - the specific AWCC feature, service or interface that mishandles privileges - is not described in the available sources, so it should not be assumed to be a race condition, insecure file permissions or a particular IPC channel without further vendor detail. Per the CPE data the affected product is identified as dell:alienware_command_center_(awcc) with no granular version breakdown beyond the vendor statement that all versions prior to 6.14.54.0 are affected. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack path with low attack complexity, no user interaction, and full impact to confidentiality, integrity and availability on the same security scope.

Know when Alienware Command Center Awcc gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (dell) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local privilege escalation by an existing low-privileged user (AV:L, PR:L) with no interaction; successful escalation grants full C/I/A control of the system.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Nov 02, 2026 - 21:18 EUVD

CVE Published

Nov 02, 2026 - 19:50 cve.org

HIGH 7.8

DescriptionCVE.org

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.

Executive ViewAI

Why It Matters

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an improper privilege management flaw that allows a local low-privileged user to escalate to higher privileges, with high impact to confidentiality, integrity, and availability. While no public exploit code or active exploitation has been identified, the vulnerability affects Windows hosts with AWCC installed and could enable significant compromise if an attacker gains local access. Leadership should prioritize patching and reducing local attack surface on systems running AWCC.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 98% exploitable

Prevalence

Low

consumer gaming utility bundled on Alienware PCs, limited enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.