EUVD-2026-80870Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Local vector and pre-existing high privilege (PR:H) plus a race/predictable-path requirement (AC:H); link-following yields only limited integrity/availability manipulation with no confidentiality impact (C:N).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
AnalysisAI
A link-following (symlink) defect in the Dell Update Package (DUP) Framework before version 26.07.03 allows a locally authenticated high-privileged attacker to plant or control a symbolic link so that a privileged DUP file operation resolves to an attacker-chosen path, producing limited integrity and availability impact on the affected host. Exploitation is tightly constrained: the attack vector is local-only (CVSS:3.1/AV:L), requires high privileges (PR:H) plus the ability to create or control symlinks in a path consumed by a DUP operation, and depends on a race or predictable-path condition (AC:H), yielding a base score of 3.0 with I:L/A:L and C:N. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already hold high local privileges (PR:H) on a host running the Dell Update Package (DUP) Framework prior to version 26.07.03, plus the ability to create or control symbolic links in a path consumed by a DUP file operation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue whose signals are internally consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Dell Update Package Framework 26.07.03 - upgrade every host running the DUP Framework to 26.07.03 or later as described in Dell Security Advisory DSA-2026-417 (https://www.dell.com/support/kbdoc/en-us/000509455/dsa-2026-417-security-update-for-dell-update-package-dup-framework-vulnerabilities); this is the only complete fix, since the flaw is in path resolution logic inside the framework and cannot be corrected by configuration alone. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Update Package Framework
View allDell Update Package Framework versions 23.12.00 through 24.12.00 suffers from improper privilege handling that allows lo
Local privilege escalation in Dell Update Package (DUP) Framework versions prior to 26.07.03 lets a low-privileged local
Local privilege escalation in the Dell Update Package (DUP) Framework (versions prior to 26.07.03) allows an attacker wh
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versi
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows
Improper link resolution in the Dell Update Package (DUP) Framework before 26.07.03 allows an attacker who already holds
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. Rated
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today