Dell Application Store EUVD-2026-104593

Exploitation requires the attacker to already have an authenticated, low-privileged local account on a host running Dell Application Store (versions prior to 26.05.0.7); it cannot be triggered remotely or by an unauthenticated user. The flaw is an incorrect permission assignment (CWE-732) on a critical resource, so it is only reachable where the affected resource exists in its misconfigured state. The CVSS AC:H metric further limits exploitation by requiring the attacker to meet a non-trivial condition such as a specific timing window or system state, reducing reliability. No user interaction is required (UI:N).

This is a genuinely moderate-severity, LOW-urgency issue rather than a top-priority fire. The CVSS 3.1 base score of 7.0 is driven largely by the maximal C:H/I:H/A:H impact flags, but the attack prerequisites temper the real-world risk substantially: AV:L requires local access to the host, PR:L requires an already-authenticated low-privileged account, and AC:H indicates the attacker must win a race or satisfy non-trivial conditions. No EPSS score, CISA KEV listing, or public exploit code is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' There is also an internal inconsistency to flag: the description states the impact is only 'Disclosure of sensitive information,' yet the vendor CVSS vector asserts full I:H and A:H as well - the description does not support integrity or availability loss, so the 7.0 score is likely inflated relative to the narrated impact; verify the true impact scope with Dell. Net: a local, authenticated, high-complexity information-disclosure flaw is a patch-in-normal-cycle item, not an emergency.

A low-privileged user already logged onto a Dell endpoint that runs Dell Application Store leverages overly permissive access controls on a critical resource (file, registry key, or IPC object) to read sensitive data they should not be able to access. Because AC:H applies, the attacker may need to exploit a timing window or a specific local state before the misconfigured resource yields its contents. No public proof-of-concept exploit is identified in the available data.