Dell ThinOS 10 EUVD-2026-65086

Exploitation requires a local user session on a Dell ThinOS 10 device running a version prior to 2605_10.2518, with at least low-privilege credentials (confirmed by CVSS PR:L). Physical presence at the device or a legitimately provisioned remote local session is necessary; remote unauthenticated exploitation is explicitly not possible given AV:L in the CVSS vector. No user interaction from a second user is required (UI:N). The scope is unchanged (S:U), confining impact to the vulnerable ThinOS device itself. Exploitation is bounded by the requirement for at least some level of authenticated local access - an external unauthenticated attacker cannot trigger this directly. The specific OS feature, subsystem, or configuration path that enforces (or fails to enforce) the relevant access control is not disclosed in available public data.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation requires local access and low-privilege credentials, with low attack complexity, no user interaction, and complete impact across all three security pillars. The local attack vector is the primary limiting factor - an attacker cannot exploit this remotely without first obtaining a foothold on the device. No EPSS score was provided in the available data, so exploitation probability cannot be quantitatively compared against the CVSS severity. This vulnerability is not listed in CISA KEV, and no public exploit code has been identified, which modestly reduces urgency relative to the raw CVSS score. The 'Authentication Bypass' tag from the source intelligence aligns with an access control failure allowing privilege escalation beyond what the assigned user role should permit. In well-managed thin client environments with strict physical access controls, real-world exposure is constrained; however, in open-access kiosk or shared-terminal deployments, risk is materially higher.

A standard low-privileged user on a Dell ThinOS 10 thin client - such as a restricted kiosk operator or shared VDI terminal user - leverages the improper access control flaw to access OS resources or configuration data outside their permitted scope. By bypassing the access restriction, the attacker achieves read and write access to sensitive system components, potentially extracting stored credentials, altering system configuration, or rendering the endpoint unavailable. No public exploit code has been identified at time of analysis, though the low attack complexity (AC:L) suggests the flaw could be discovered and triggered without specialized tooling.