Dell SmartFabric OS10 EUVD-2026-78770

Requires network reachability to the Dell SmartFabric OS10 management/web session interface on a version prior to 10.6.1.3. As a session fixation flaw, successful session theft depends on a legitimate user (typically an administrator) authenticating into a session identifier the attacker has fixed or knows - this victim-login step is the primary limiting factor and effectively adds a user-interaction requirement not captured by the vendor UI:N. Impact is bounded by the privilege of the hijacked account. There is no referenced PoC and SSVC records no observed exploitation.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) overstates this issue in two respects. First, the vulnerability class is session fixation (mapped generically here to CWE-284 Improper Access Control; the precise weakness is CWE-384). Session fixation attacks almost always require the legitimate victim to authenticate into an attacker-controlled/attacker-known session identifier, which realistically implies user interaction (UI:R) rather than UI:N. Second, C:H/I:H/A:H assumes full triad compromise, but the described impact is 'session theft' - the attacker inherits whatever the hijacked account can do. That yields confidentiality and integrity impact bounded by the victim's role, and no inherent availability impact (A:H is not supported by the description). The corroborating signals argue for measured prioritization rather than emergency response: SSVC records Exploitation=none (no observed activity), there is no CISA KEV listing, and no public PoC is referenced. SSVC Automatable=yes and Technical Impact=total do raise the ceiling, but 'automatable' is questionable given the victim-login dependency of session fixation. In short: a genuine, patchable session-management flaw on a network-OS management plane, but the 9.8 rating is inflated versus the actual described impact - treat as high, not maximal, and confirm the exploitation preconditions with Dell (DSA-2026-343).

An unauthenticated remote attacker plants or fixes a known session identifier for the OS10 management interface, then induces an administrator to authenticate against that pre-set session (e.g., via a crafted link). Once the admin logs in, the attacker reuses the now-authenticated session token to access the switch management plane as that user. No public exploit code is referenced and exploitation is not automatable end-to-end without the victim login step.