Dell Application Store EUVD-2026-104591

Exploitation requires the attacker to already possess local, low-privileged access to a system running Dell Application Store at a version prior to 26.05.0.7 (PR:L confirms an existing authenticated/interactive foothold is mandatory). The core precondition is that the attacker can write to or control a directory or path element that the Application Store searches when loading a library or executable (CWE-427), allowing a planted malicious component to be loaded by the higher-privileged process. Limiting factors: no remote exploitation is possible (AV:L), no user interaction by a victim is needed (UI:N), and the scope is unchanged (S:U), so impact is confined to the host; an attacker lacking any local account or code-execution primitive cannot trigger this. Patched builds (26.05.0.7 and later) remove the exposure.

This is a credible but operationally-bounded privilege-escalation issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms local-only exploitation requiring the attacker to already hold low-level privileges on the host; there is no network-reachable component. CWE-427 (Uncontrolled Search Path Element) indicates a classic library/binary planting weakness where the application resolves a path element the attacker can influence. No EPSS score, CISA KEV entry, SSVC decision, or proof-of-concept was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.8 is a high-but-local severity rather than a signal of widespread opportunistic attack. The signals are internally consistent (local vector, requires existing foothold, high triple impact typical of EoP), with no contradictions between CVSS and the description. Priority should be treated as a standard-to-expedited patch for Dell-endpoint fleets as a post-compromise hardening measure, below internet-facing RCE issues. Note: EPSS and exploitation-maturity data are absent, so any probability-based prioritization cannot be computed from the provided data.

An attacker who already has low-privileged local access to a Dell endpoint (e.g., a standard user account or a foothold from phishing) plants a malicious library or executable in a directory the Dell Application Store searches when resolving a path element. When the Application Store process - running at higher privilege - loads that attacker-controlled component, it executes the attacker's code, elevating from a standard user to the application's/system's privilege level. No public proof-of-concept was provided in the input.