What is the CVSS score of EUVD-2026-17873?

EUVD-2026-17873 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell are affected by EUVD-2026-17873?

Dell AppSync 4.6.0 contains a privilege escalation vulnerability that allows authenticated local users to gain system-level access, potentially compromising confidentiality, integrity, and…. A patch is available.

How to fix or mitigate EUVD-2026-17873?

Within 24 hours: Inventory all Dell AppSync 4.6.0 instances and restrict local access to trusted administrators only. Within 7 days: Apply Dell security patch per DSA-2026-163 to all affected systems, prioritizing production infrastructure. Within 30 days: Verify patch deployment across all AppSync instances and validate privilege escalation controls through security testing.

Dell EUVD-2026-17873

| CVE-2026-22768 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-04-01 dell

Dell Information Disclosure

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.6.1.0

EUVD ID Assigned

Apr 01, 2026 - 13:00 euvd

EUVD-2026-17873

Analysis Generated

Apr 01, 2026 - 13:00 vuln.today

CVE Published

Apr 01, 2026 - 12:18 nvd

HIGH 7.3

DescriptionCVE.org

Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Incorrect permission assignment in Dell AppSync 4.6.0 enables local privilege escalation to high-impact system access. Authenticated attackers with low-privilege local access can exploit misconfigured resource permissions to elevate privileges, achieving full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis. Dell has released security advisory DSA-2026-163 addressing this vulnerability. EPSS data unavailable; CVSS 7.3 reflects significant local threat requiring user interaction.

Technical ContextAI

This vulnerability affects Dell AppSync version 4.6.0, a data protection and copy data management solution (CPE: cpe:2.3:a:dell:appsync:*:*:*:*:*:*:*:*). The issue stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the application fails to properly restrict permissions on system-critical resources such as configuration files, executables, or service objects. When permissions are overly permissive, low-privileged users can modify or replace critical resources that are subsequently executed or processed by higher-privileged system components. This class of vulnerability typically involves weak file system ACLs, world-writable directories in privileged search paths, or insecure registry key permissions on Windows systems. The local attack vector (AV:L) indicates exploitation requires authenticated access to the system where AppSync is deployed, commonly targeting enterprise backup and disaster recovery infrastructure where AppSync manages application-consistent snapshots and replication.

RemediationAI

Organizations running Dell AppSync 4.6.0 should immediately apply the security update referenced in Dell Security Advisory DSA-2026-163 available at https://www.dell.com/support/kbdoc/en-us/000446965/dsa-2026-163-security-update-for-dell-appsync-vulnerabilities. The advisory contains patched versions and upgrade procedures specific to this vulnerability. Until patching is complete, implement compensating controls including restricting local system access to AppSync servers to only essential administrative personnel, enabling comprehensive file integrity monitoring on AppSync installation directories, auditing all privilege escalation attempts through Windows Event Logs or syslog, and reviewing current file system permissions on AppSync binaries and configuration files to ensure only SYSTEM and authorized administrator accounts have write access. If AppSync manages sensitive production data, consider isolating affected systems on restricted network segments and implementing least-privilege access controls through Active Directory group policies or equivalent identity management solutions. Post-remediation, verify proper permission assignments on all AppSync-related resources and review audit logs for any suspicious elevation attempts during the vulnerable period.