Dell Inventory Collector Client EUVD-2026-35766

Exploitation requires an attacker to already have a local, authenticated session on the target system with at minimum low OS-level privileges (confirmed by CVSS PR:L). The attack vector is strictly local (CVSS AV:L) - remote unauthenticated exploitation is not possible. High attack complexity (CVSS AC:H) indicates that successful exploitation depends on winning a race condition or achieving precise filesystem state manipulation (e.g., placing a symlink at the exact path and time the Inventory Collector Client resolves it), meaning exploitation is not reliable or automated without significant attacker effort. The vulnerability is specific to Dell Inventory Collector Client versions prior to 13.8.0; systems running 13.8.0 or later are not affected. No specific non-default configuration is stated as required - the vulnerability appears present in the default operation of the affected versions.

The CVSS base score of 6.3 (Medium) reflects constrained real-world exploitability: the attack is local-only (AV:L), requires low but non-zero privileges (PR:L), and has high attack complexity (AC:H), consistent with a race-condition or symlink-race scenario that demands precise timing or filesystem manipulation. The integrity and availability impacts are both rated High (I:H/A:H), meaning a successful attack can overwrite critical files - potentially causing service disruption or privilege escalation if a sensitive system file is overwritten. Confidentiality is unaffected (C:N). No EPSS score was provided in the input data; exploitation probability cannot be quantified from available signals. There is no KEV listing and no public exploit identified at time of analysis. Self-disclosure by Dell (DSA-2026-215) and prompt patch release to version 13.8.0 suggest responsible handling. Risk priority is moderate: the local-only, high-complexity attack surface limits opportunistic exploitation, but the file-write primitive could be chained in a multi-stage attack on an already-compromised endpoint. The tag 'Information Disclosure' in the source metadata conflicts with the CVSS C:N rating - this may be a mis-tag or indicate a secondary information exposure not captured in the base vector; defenders should review the full advisory for clarification.

A low-privileged local user on a system running Dell Inventory Collector Client below 13.8.0 identifies a predictable temporary file path or directory used by the client during an inventory collection cycle. The attacker replaces or pre-creates a symlink at that path pointing to a sensitive target file (e.g., a system configuration file or binary). When the Inventory Collector Client executes its file write operation and follows the symlink, it writes attacker-influenced content to the target file, potentially corrupting it or enabling privilege escalation. No public exploit code has been identified at time of analysis, but the attack primitive is well-understood within the link-following vulnerability class.